hostus.us Host.us WHMCS Security Breach

eva2000 · Feb 18, 2024

Heads up if you have a Host.us VPS server. It seems their WHMCS billing and account management software had a security breach due to recent security vulnerabilities in the WHMCS theme Lagom Client Theme https://lowendtalk.com/discussion/192812/hostus-critical-whmcs-data-breach

https://lowendtalk.com/discussion/192300/rstheme-critical-update

https://www.webhostingtalk.com/showthread.php?t=1912021

About the Security Issue
The issue pertains to a specific function that allowed customers to upload image files (PNG, JPG, SVG, and GIF) when logged into the WHMCS client area. This function used PHP MIME type checks to ensure only these image formats could be uploaded. However, we have discovered that the MIME function’s security measures are not entirely foolproof.
It has come to our attention that skilled hackers could exploit this function. They could bypass the intended restrictions by executing a particular URL, allowing them to upload a PHP file. This vulnerability poses a significant security risk.
Click to expand...

We regret to inform you about a security breach that has happened with our WHMCS client billing system (my.hostus.us) caused by a recent security vulnerability identified in our WHMCS theme Lagom Client Theme, which has led to unauthorised access to our WHMCS database by a hacker. We must acknowledge the possibility that the data accessed during this breach could potentially be misused. We cannot guarantee with absolute certainty that the data that was accessed will remain secure. Therefore, we urge you to implement all necessary precautions to protect your account, services and systems.

If your service (VPS, Shared hosting etc) account password was not changed from the original password that the service was set up with please change it immediately. Please also change your HostUS Customer account password via my.hostus.us We sincerely apologise for any inconvenience this may have caused. Please understand that we are doing everything within our power to assist and support you during this time.

We are currently producing a full transparency report to provide to our customers. It’s with great sadness that this has happened. It’s with great sadness that I send you this email, please be assured we are doing everything in our power with this situation.

If you have any questions or queries please contact me directly at security@hostus.us We will also be emailing further updates and full timeline and transparency.

Kind Regards,
Alexander
HostUS
Click to expand...

Log in / Register

Forums

Join the community today

hostus.us Host.us WHMCS Security Breach

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

hostus.us Host.us WHMCS Security Breach

eva2000 Administrator Staff Member

.