CVE-2013-3536: SQL Injection
Published May 13, 2013
·Updated
SQL injection vulnerability in the gpLoadUserFromHash function in functionshash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
Affected Software
2 affected components
WHMCS Group Pay<=1.5
WHMCS WHMCS
Event History
May 13, 2013
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-3536?
CVE-2013-3536 has a medium severity level due to its potential for SQL injection attacks.
2
How do I fix CVE-2013-3536?
To fix CVE-2013-3536, upgrade your Group Pay module to a version later than 1.5 that has patched the SQL injection vulnerability.
3
What types of attacks can CVE-2013-3536 enable?
CVE-2013-3536 can enable remote attackers to execute arbitrary SQL commands against your database.
4
Which versions of WHMCS are affected by CVE-2013-3536?
CVE-2013-3536 affects Group Pay module version 1.5 and earlier for WHMCS.
5
How can I determine if I am vulnerable to CVE-2013-3536?
You can determine if you are vulnerable to CVE-2013-3536 by checking if you are using the Group Pay module version 1.5 or earlier.