<?php
function select_query($table, $fields, $where, $orderby = '', $orderbyorder = '', $limit = '', $innerjoin = '') {
    global $CONFIG;
    global $query_count;
    global $mysql_errors;
    global $whmcsmysql;
    if (!$fields) {
    $fields = '*';
    }
    $query = 'SELECT ' . $fields . ' FROM ' . db_make_safe_field($table);
    if ($innerjoin) {
    $query .= ' INNER JOIN ' . db_escape_string($innerjoin);
    }
    if ($where) {
    if (is_array($where)) {
        $criteria = array();
        foreach ($where as $origkey => $value) {
        $key = db_make_safe_field($origkey);
        if (is_array($value)) {
            if ($key == 'default') {
            $key = '`default`';
            }
            if ($value['sqltype'] == 'LIKE') {
            $criteria[] = $key . ' LIKE \'%' . db_escape_string($value['value']) . '%\'';
            continue;
            }
            if ($value['sqltype'] == 'NEQ') {
            $criteria[] = $key . '!=\'' . db_escape_string($value['value']) . '\'';
            continue;
            }
            if ($value['sqltype'] == '>') {
            $criteria[] = $key . '>' . db_escape_string($value['value']);
            continue;
            }
            if ($value['sqltype'] == '<') {
            $criteria[] = $key . '<' . db_escape_string($value['value']);
            continue;
            }
            if ($value['sqltype'] == '<=') {
            $criteria[] = $origkey . '<=' . db_escape_string($value['value']);
            continue;
            }
            if ($value['sqltype'] == '>=') {
            $criteria[] = $origkey . '>=' . db_escape_string($value['value']);
            continue;
            }
            if ($value['sqltype'] == 'TABLEJOIN') {
            $criteria[] = $key . '=' . db_escape_string($value['value']);
            continue;
            }
            if ($value['sqltype'] == 'IN') {
            $criteria[] = $key . ' IN (\'' . implode('\',\'', db_escape_array($value['values'])) . '\')';
            continue;
            }
            continue;
        }
[...]
?>

<?php
function update_query($table, $array, $where) {
    #[...]
    if (substr($value, 0, 11) == 'AES_ENCRYPT') {
        $query .= $value.',';
        continue;
    }
    #[...]
    $result = mysql_query($query, $whmcsmysql);
 }
?>



and download exploit from following link

Exploit in python:

http://www.mediafire.com/download/bep724fwr8t4scl/whmcs.py


Exploit in php:

http://www.mediafire.com/download/5y10bzblp9bo92q/cyberaon(2).php

Register a new user on a target WHMCS install (/register.php)

 
and edit the exploit with site name, email and password.