Security Advisory: WHMCS Admin Password Reset Weak Token
A weak token generation flaw in WHMCS's admin password reset flow is fixed in this security release: predictable reset tokens put administrator accounts at takeover risk. Update WHMCS from the Admin Area and rotate admin credentials as a precaution.
प्रभावित संस्करण
WHMCS 8.9.0 and earlier
पैच किया गया संस्करण
WHMCS 8.10.1
डिफ़ॉल्ट अपडेट कमांड
yum update -yसुधार कमांड
All Systems
Back up /var/www/html/whmcs
Download the patched release
Run the upgrade wizard at /install/upgradeSharedLicense लाइसेंस के तहत इसका अर्थ
Your SharedLicense license itself is not affected — this is a change in WHMCS software, not in licensing. Apply it on every affected server: update to the fixed release from the WHMCS Admin Area. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
Password reset flows are only as strong as the secrecy of their tokens. WHMCS‘s admin reset tokens were generated too predictably, so an attacker who could request a reset and predict the token could set a new administrator password — full control of the billing and provisioning platform.
Who is affected
WHMCS installations — which concentrate customer records, invoices and hosting account credentials in one internet-exposed system. Admin compromise there is about the worst single event a hosting business can have.
How to apply the fix
- Update WHMCS to the fixed release from the Admin Area.
- Rotate administrator passwords after updating.
- Review admin accounts and recent password-reset requests in the logs.
For SharedLicense customers
Licensing is unaffected — this is WHMCS software. Given what a WHMCS holds, treat this update as priority even though the flaw is now patched.
अक्सर पूछे जाने वाले प्रश्न
What was wrong with the reset tokens?
What should I do besides updating?
How is WHMCS updated?
संदर्भ
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें