By Matt / October 25th, 2013
UPDATE 2: We have published 5.2.12 incremental and full versions. These include all security related enhancements as well as the missing file that triggers the version increment.
Please Note: if you downloaded 5.2.11, your update is incomplete. Please deploy 5.2.12 to ensure the software version increments properly. Version 5.1.13 was not affected by this packaging deficiency.
UPDATE: We've identified a missing file in 5.2.11 which causes the version number not to increment. All security related enhancements are present. We will be updating this post again with version 5.2.12 which will contain the complete change set. Thank you for you patience.
WHMCS has released new patches for the 5.2 and 5.1 minor releases. These updates provide targeted changes to address security concerns with the WHMCS product. You are highly encouraged to update immediately.
WHMCS has rated these updates as having critical & important security impacts. Information on security ratings is available at https://docs.whmcs.com/Security_Levels
ReleasesThe following patch release versions of WHMCS have been published to address all known vulnerabilities:
Security Issue Information
These updates resolve the following issues:
> Information disclosure via the client area as published by 'localhost'
> HTTP Split Attack discovered by the WHMCS Development Team
> SQL Injection Vulnerability discovered by the WHMCS Development Team
> Privilege boundaries not being enforced on addons reported by Vlad C of NetSec Interactive
> Download directory traversal reported privately by an individual
> Lack of input validation in data feeds input discovered by the WHMCS Development Team
> Deficient Null Byte sanitization on input discovered by the WHMCS Development Team
Important Fix Information
These updates also include the following non-security related functional fixes:
> Improved validation of monetary amounts
> Moneris Vault Gateway compatibility update
> Credit cards not processing under certain conditions
> Correction to internal logic for testing Authorize.net payment gateway