hack whmcs v7

[saadatidust]

hi
I'm using a whmcs system that has null version 7.
A few days ago, a hacker hacked it and did whatever he wanted with the admin access level. And he put his PayPal address in the site and my customers unknowingly deposited money into his account. I deleted his username several times but it still comes up. I encrypted the login path to the admin page and even renamed it. I even changed the access login page of the admin page to my own IP, but it still has access to the admin panel.
I do not know where they get access to this password? Does he have access to CNN or whmcs himself ?? If it has access to whmcs then how can you edit the .htaccess file?
What is the way to remove his access?

Can you check the subject? I was really upset and could only get out of the way.

 

[Bossmanuk]

Firstly, Welcome to Babiato!
Your WHMCS script is only as secure as your server as both need to work in harmony.

You also need to look at upgrading to the lastest version to make sure there is no security issues with the script.

What is your server environment? Shared, VPS or Dedicated

Does the server have real-time antivirus and malware scanners?

Do the server have a firewall and modsecurity installed?

Where did you get the WHMCS from is it safe or does it have a backdoor?

These are the basics you need to ask yourself before you can really secure your WHMCS.

 

[lorddoom]

hi
I'm using a whmcs system that has null version 7.
A few days ago, a hacker hacked it and did whatever he wanted with the admin access level. And he put his PayPal address in the site and my customers unknowingly deposited money into his account. I deleted his username several times but it still comes up. I encrypted the login path to the admin page and even renamed it. I even changed the access login page of the admin page to my own IP, but it still has access to the admin panel.
I do not know where they get access to this password? Does he have access to CNN or whmcs himself ?? If it has access to whmcs then how can you edit the .htaccess file?
What is the way to remove his access?

Can you check the subject? I was really upset and could only get out of the way.

Hello, if possible dm me, i may help you out with a possible solution, alternatively i recommend to update the whmcs version to the latest.

 

[saadatidust]

Firstly, Welcome to Babiato!
Your WHMCS script is only as secure as your server as both need to work in harmony.

You also need to look at upgrading to the lastest version to make sure there is no security issues with the script.

What is your server environment? Shared, VPS or Dedicated

Does the server have real-time antivirus and malware scanners?

Do the server have a firewall and modsecurity installed?

Where did you get the WHMCS from is it safe or does it have a backdoor?

These are the basics you need to ask yourself before you can really secure your WHMCS.

Hello
The server has a firewall
Our hosting is shared
I downloaded and installed whmcs from Babiato.

 

[saadatidust]

I feel that he has full access to Cpanle

 

[saadatidust]

The username he uses is exactly the same as my whmcs system admin username, with only one number added to the end.
Does he have access to C Panel or does he create this username via Sql injection?

 

[lorddoom]

I feel that he has full access to Cpanle

and that's where things are going wrong! CHANGE YOUR HOSTING FIRST OF ALL. and what's the username ?

 

[mogrosso]

who is your hosting?

 

[nobs]

The username he uses is exactly the same as my whmcs system admin username, with only one number added to the end.
Does he have access to C Panel or does he create this username via Sql injection?

Good day

UPDATE​

UPDATE​

UPDATE​

All your systems.

WHMCS and any scripts are not updated to look cool.
They are because of security concerns.

The hacker, either knows a vulnerability in version 7 or your server is not up to date.

In any case, stop talking here and update your WHMCS to the latest version, then come back and talk for more help.

Cheers.
NoBs

 

[Bossmanuk]

Hello
The server has a firewall
Our hosting is shared
I downloaded and installed whmcs from Babiato.

Update WHMCS to the latest version, then change all passwords on the server Cpanel including emails. Then scan the server with Clamav or maldetect if you don't know what they are please ask your hosting provider if they can install it on the server for you. Scan all directories and see if it detects any backdoors etc.

 

[saadatidust]

who is your hosting?

High Performance Cloud Services | Reliable | Phanes Cloud

Build your business on our reliable high performance cloud services ✓ Premium quality! ✓ Privacy first!

flaunt7.com

 

[mogrosso]

High Performance Cloud Services | Reliable | Phanes Cloud

Build your business on our reliable high performance cloud services ✓ Premium quality! ✓ Privacy first!

flaunt7.com

Ive never heard of this hosting. doesn't look professional

 

[saadatidust]

Exactly I doubt them too.
Friends, can you help me find a suitable feeling? Hosts that support DMCA?

 

[pateljee]

First of all, If you are using it for service purpose, Then VPS or cloud is best option for any reputed company.
I am running my approx all website of AWS and Digital Ocean Droplet, It charged very less than any other hosting provider.
I have received several time promotional code.

In This case, It is SQL injection or access through your cpanel.

 

[saadatidust]

First of all, If you are using it for service purpose, Then VPS or cloud is best option for any reputed company.
I am running my approx all website of AWS and Digital Ocean Droplet, It charged very less than any other hosting provider.
I have received several time promotional code.

In This case, It is SQL injection or access through your cpanel.

How can I fix the problem?

 

[pateljee]

How can I fix the problem?

First check Cpanel, Is there any malicious code available.
Then Change all password.
If after this, Still he is accessing your site, then Last option change your hosting provider.

 

[saadatidust]

C Panel has detected these files as malicious. How do I delete them? Should I delete them manually?

 

[pateljee]

First, Delete these file.

From Here, They are accessing your site.

 

[saadatidust]

The hosting provider asked me to send them my last backup from last year so they could run it on another host for me.
The problem is that we new users are used to whmcs .. Can I restore the database backup on that new host after restoring old files so that my new users' information is not lost?

 

[pateljee]

The hosting provider asked me to send them my last backup from last year so they could run it on another host for me.
The problem is that we new users are used to whmcs .. Can I restore the database backup on that new host after restoring old files so that my new users' information is not lost?

Yes. You can use this backup.