is whmcs still ok ?

Discussion in 'Security' started by applehost, Aug 17, 2012.

0
  1. #1
    Hi,

    for their new version,it seems it still has many issues and i do not want to upgrade to it,

    because i find still many bugs report on their forum.

    im not sure if it is because they are working hard to debug now,

    they do not have many time to reply ticket,

    because my ticket was replyed about 15 days ago,no reply any more,

    i really worry if they are having any issue now.
     
    applehost, Aug 17, 2012 IP
  2. Noticed

    Noticed Active Member

    Messages:
    201
    Likes Received:
    8
    Best Answers:
    1
    Trophy Points:
    75
    #2
    I think it's safe to use still, I use it and have no problems.
     
    Noticed, Aug 25, 2012 IP
  3. vcreationzz

    vcreationzz Peon

    Messages:
    34
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    I am latest version as well, didn't noticed any bug actually effecting software performance..
     
    vcreationzz, Oct 3, 2012 IP
  4. backupgreen

    backupgreen Peon

    Messages:
    7
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Yes. You may upgrade to the latest version. I've not noticed any bugs in the latest version.
     
    backupgreen, Oct 9, 2012 IP
  5. SolidShellSecurity

    SolidShellSecurity Banned

    Messages:
    262
    Likes Received:
    3
    Best Answers:
    1
    Trophy Points:
    45
    #5
    As long as you secure it correctly yes. We recently just secured a businesses WHMCS after they got hacked so it's important that everything is setup correctly.
     
    SolidShellSecurity, Oct 10, 2012 IP
  6. blockdos

    blockdos Active Member

    Messages:
    96
    Likes Received:
    0
    Best Answers:
    3
    Trophy Points:
    71
    #6
    You gotta be very careful with WHMCS, Always lock down the admin section by renaming folder and allowing to only certain ips with .htaccess or iptables. Make sure to keep it up to date, disable all attachment upload and there is a few other things you can do as well.

    WHMCS has had a bad track record but it is a good and useful software. For the longest time, until I an others at WHT screamed about it, You could find the admin section and reset the admin pass over and over without any sort of confirmation at all. All you would have to do is put lost pass for admin and it would reset the pass and send to them. It may be useless as a hack if you dont have access to admin email but you could totally cause lots of trouble with it if you automated it. And to this day, I still do not think they have it fixed, only made something that turns it off.

    A proper password reset would send an email to the admin or whoever asking them if they asked for it, a lnk to confirm, and then it would send pass. With WHMCS simply resetting and sending pass that makes me weary they could not properly fix this, only add a jerry rig fix to it.

    And not only that, when confronted with this issue via my emails, the post at WHT and such the creator was very arrogant and dismissive until finally a lot of people was posting about it, then they implemented their so called fix.

    To use WHMCS the best way, is to lock it down and NEVER link servers to it with root, always use a reseller account. As far as creating resellers you would either have to add permissions manually or get WHMEXTRA which I think allows a reseller account to create resellers.
     
    blockdos, Nov 5, 2012 IP