WHMCompleteSolution PayPal and Google Checkout Modules
WHMCompleteSolution PayPal and Google Checkout Modules Vulnerabilities
Release Date : 2013-01-04
Criticality level : Less critical
Impact: Manipulation of data
Where : From remote
Solution Status : Vendor Patch
Software: WHMCompleteSolution 4.x
Two vulnerabilities have been reported in WHMCompleteSolution, which can be exploited by malicious users to bypass certain security restrictions and conduct SQL injection attacks.
1) An error when handling PayPal transactions within the paypal module can be exploited to credit a different PayPal account than the application configured PayPal account.
Successful exploitation of this vulnerability requires the paypal module to be enabled.
2) Certain input passed to the Google checkout module is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Successful exploitation of this vulnerability requires the Google checkout module to be enabled.
The vulnerabilities are reported in versions prior to 4.5.3.
Update to version 4.5.3 or apply patch.
Provided and/or discovered by:
Reported by the vendor.