How WHMCS Gets Hacked: Attack Vectors & Prevention Methods

# VULNERABLE CODE (Never use this pattern)
<?php
// Custom template search - DANGEROUS!
$search = $_GET['search'];
$query = "SELECT * FROM tblclients WHERE firstname LIKE '%$search%'";
$result = mysql_query($query); // Direct injection possible

// Login bypass vulnerability
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM tbladmins WHERE username='$username' AND password='$password'";

// File upload without validation
move_uploaded_file($_FILES['file']['tmp_name'], "uploads/" . $_FILES['file']['name']);
?>

# ATTACK PAYLOADS USED
# Search injection:
search=' UNION SELECT username,password FROM tbladmins--

# Login bypass:
username=admin'/*&password=*/or/**/1=1--

# File upload:
malicious.php.jpg (double extension bypass)

<?php
/**
 * Secure WHMCS Custom Code Implementation
 * Always use these patterns for custom templates and hooks
 */

// 1. SECURE DATABASE QUERIES - Use prepared statements
function secure_client_search($search_term) {
    try {
        $pdo = \WHMCS\Database\Capsule::connection()->getPdo();
        
        // Prepared statement prevents injection
        $stmt = $pdo->prepare("
            SELECT id, firstname, lastname, email 
            FROM tblclients 
            WHERE (firstname LIKE ? OR lastname LIKE ?) 
            AND status = 'Active'
            LIMIT 50
        ");
        
        $search_param = '%' . $search_term . '%';
        $stmt->execute([$search_param, $search_param]);
        
        return $stmt->fetchAll(PDO::FETCH_ASSOC);
        
    } catch (Exception $e) {
        logActivity("Search error: " . $e->getMessage());
        return [];
    }
}

// 2. SECURE INPUT VALIDATION
function validate_and_sanitize_input($input, $type = 'string') {
    // Remove null bytes and control characters
    $input = str_replace(chr(0), '', $input);
    $input = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', '', $input);
    
    switch ($type) {
        case 'email':
            return filter_var($input, FILTER_VALIDATE_EMAIL);
            
        case 'integer':
            return filter_var($input, FILTER_VALIDATE_INT);
            
        case 'domain':
            return filter_var($input, FILTER_VALIDATE_DOMAIN);
            
        case 'alphanumeric':
            return preg_match('/^[a-zA-Z0-9]+$/', $input) ? $input : false;
            
        default:
            // Basic XSS prevention
            return htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
    }
}

// 3. SECURE FILE UPLOAD HANDLING
function secure_file_upload($file, $allowed_types = ['jpg', 'png', 'pdf']) {
    $upload_dir = '/secure/uploads/';
    $max_size = 5 * 1024 * 1024; // 5MB
    
    // Validate file
    if (!isset($file['tmp_name']) || !is_uploaded_file($file['tmp_name'])) {
        return ['success' => false, 'error' => 'Invalid file upload'];
    }
    
    // Check file size
    if ($file['size'] > $max_size) {
        return ['success' => false, 'error' => 'File too large'];
    }
    
    // Validate file type by content, not just extension
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    
    $allowed_mimes = [
        'jpg' => 'image/jpeg',
        'png' => 'image/png', 
        'pdf' => 'application/pdf'
    ];
    
    $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    
    if (!in_array($extension, $allowed_types) || 
        !in_array($mime_type, array_values($allowed_mimes))) {
        return ['success' => false, 'error' => 'Invalid file type'];
    }
    
    // Generate secure filename
    $secure_filename = bin2hex(random_bytes(16)) . '.' . $extension;
    $full_path = $upload_dir . $secure_filename;
    
    // Move file
    if (move_uploaded_file($file['tmp_name'], $full_path)) {
        // Set secure permissions
        chmod($full_path, 0644);
        
        return ['success' => true, 'filename' => $secure_filename];
    }
    
    return ['success' => false, 'error' => 'Upload failed'];
}

// 4. SECURE AUTHENTICATION CHECKS
function verify_admin_session() {
    // Check if admin is logged in using WHMCS functions
    if (!isset($_SESSION['adminid']) || empty($_SESSION['adminid'])) {
        return false;
    }
    
    // Verify session token
    if (!isset($_SESSION['admin_token']) || 
        !hash_equals($_SESSION['admin_token'], $_POST['token'] ?? '')) {
        return false;
    }
    
    // Check session timeout (30 minutes)
    if (time() - $_SESSION['last_activity'] > 1800) {
        session_destroy();
        return false;
    }
    
    $_SESSION['last_activity'] = time();
    return true;
}

// 5. SECURE API CALLS
function secure_whmcs_api_call($command, $params = []) {
    try {
        // Validate command
        $allowed_commands = [
            'GetClientsDetails', 'GetOrders', 'GetInvoices',
            'GetTickets', 'GetProducts', 'GetDomains'
        ];
        
        if (!in_array($command, $allowed_commands)) {
            throw new Exception("Unauthorized API command: $command");
        }
        
        // Add authentication
        $params['username'] = WHMCS_API_USER;
        $params['password'] = WHMCS_API_PASS;
        $params['action'] = $command;
        $params['responsetype'] = 'json';
        
        // Make secure API call
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, WHMCS_API_URL);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        
        $response = curl_exec($ch);
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        
        if ($httpCode !== 200) {
            throw new Exception("API call failed with HTTP $httpCode");
        }
        
        $data = json_decode($response, true);
        
        if ($data['result'] !== 'success') {
            throw new Exception("API error: " . $data['message']);
        }
        
        return $data;
        
    } catch (Exception $e) {
        logActivity("Secure API call error: " . $e->getMessage());
        return ['result' => 'error', 'message' => $e->getMessage()];
    }
}

// 6. EXAMPLE SECURE TEMPLATE USAGE
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Verify CSRF token
    if (!verify_admin_session()) {
        die('Unauthorized access');
    }
    
    // Sanitize and validate input
    $client_id = validate_and_sanitize_input($_POST['client_id'], 'integer');
    $search_term = validate_and_sanitize_input($_POST['search'], 'string');
    
    if ($client_id && $search_term) {
        // Secure database operation
        $results = secure_client_search($search_term);
        
        // Output with XSS protection
        foreach ($results as $client) {
            echo '<tr>';
            echo '<td>' . htmlspecialchars($client['firstname'], ENT_QUOTES) . '</td>';
            echo '<td>' . htmlspecialchars($client['email'], ENT_QUOTES) . '</td>';
            echo '</tr>';
        }
    }
}
?>

# COMMON MALICIOUS UPLOADS

# 1. Double Extension Bypass
malicious.php.jpg
backdoor.php.png
webshell.asp.gif

# 2. Null Byte Injection  
shell.php%00.jpg
backdoor.asp\x00.png

# 3. MIME Type Spoofing
Content-Type: image/jpeg
(but contains PHP code)

# 4. Directory Traversal
../../../var/www/html/shell.php
..\..\..\..\windows\system32\evil.exe

# 5. Web Shell Examples




# 6. Steganography
# PHP code hidden in image metadata
# Image looks normal but contains executable payload

<?php
/**
 * Enterprise-Grade File Upload Security
 * Used by major hosting companies to prevent breaches
 */

class SecureFileUpload {
    
    private $allowed_extensions = ['jpg', 'jpeg', 'png', 'pdf', 'doc', 'docx'];
    private $allowed_mime_types = [
        'image/jpeg' => ['jpg', 'jpeg'],
        'image/png' => ['png'],
        'application/pdf' => ['pdf'],
        'application/msword' => ['doc'],
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ['docx']
    ];
    private $max_file_size = 10485760; // 10MB
    private $upload_path = '/secure/uploads/';
    private $quarantine_path = '/secure/quarantine/';
    
    public function validateAndUpload($file, $additional_checks = true) {
        $result = ['success' => false, 'error' => '', 'filename' => '', 'quarantined' => false];
        
        try {
            // Basic validation
            if (!$this->basicValidation($file, $result)) {
                return $result;
            }
            
            // Advanced security checks
            if ($additional_checks && !$this->advancedValidation($file, $result)) {
                return $result;
            }
            
            // Generate secure filename
            $secure_filename = $this->generateSecureFilename($file);
            $final_path = $this->upload_path . $secure_filename;
            
            // Move file to secure location
            if (move_uploaded_file($file['tmp_name'], $final_path)) {
                
                // Set restrictive permissions
                chmod($final_path, 0644);
                
                // Log the upload
                $this->logUpload($file, $secure_filename, $_SERVER['REMOTE_ADDR']);
                
                $result['success'] = true;
                $result['filename'] = $secure_filename;
                
            } else {
                $result['error'] = 'Failed to move uploaded file';
            }
            
        } catch (Exception $e) {
            $result['error'] = 'Upload processing error: ' . $e->getMessage();
            error_log("Secure upload error: " . $e->getMessage());
        }
        
        return $result;
    }
    
    private function basicValidation($file, &$result) {
        // Check if file was actually uploaded
        if (!isset($file['tmp_name']) || !is_uploaded_file($file['tmp_name'])) {
            $result['error'] = 'Invalid file upload';
            return false;
        }
        
        // Check file size
        if ($file['size'] > $this->max_file_size) {
            $result['error'] = 'File exceeds maximum size limit';
            return false;
        }
        
        // Check for upload errors
        if ($file['error'] !== UPLOAD_ERR_OK) {
            $result['error'] = 'Upload error: ' . $this->getUploadErrorMessage($file['error']);
            return false;
        }
        
        return true;
    }
    
    private function advancedValidation($file, &$result) {
        
        // 1. Extension validation (case insensitive)
        $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
        if (!in_array($extension, $this->allowed_extensions)) {
            $result['error'] = 'File type not allowed';
            return false;
        }
        
        // 2. MIME type validation using file content
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $detected_mime = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);
        
        if (!array_key_exists($detected_mime, $this->allowed_mime_types)) {
            $result['error'] = 'Invalid file content type';
            return false;
        }
        
        // 3. Cross-validate extension with MIME type
        if (!in_array($extension, $this->allowed_mime_types[$detected_mime])) {
            $result['error'] = 'File extension does not match content';
            return false;
        }
        
        // 4. Check for embedded PHP code
        if ($this->containsPHPCode($file['tmp_name'])) {
            $this->quarantineFile($file, 'Contains PHP code');
            $result['error'] = 'Malicious content detected';
            $result['quarantined'] = true;
            return false;
        }
        
        // 5. Image-specific validation
        if (in_array($detected_mime, ['image/jpeg', 'image/png'])) {
            if (!$this->validateImage($file['tmp_name'])) {
                $this->quarantineFile($file, 'Invalid image structure');
                $result['error'] = 'Corrupted or malicious image';
                $result['quarantined'] = true;
                return false;
            }
        }
        
        // 6. PDF-specific validation
        if ($detected_mime === 'application/pdf') {
            if (!$this->validatePDF($file['tmp_name'])) {
                $this->quarantineFile($file, 'Suspicious PDF content');
                $result['error'] = 'Invalid PDF file';
                $result['quarantined'] = true;
                return false;
            }
        }
        
        // 7. Filename security check
        if (!$this->isSecureFilename($file['name'])) {
            $result['error'] = 'Insecure filename detected';
            return false;
        }
        
        return true;
    }
    
    private function containsPHPCode($filepath) {
        $content = file_get_contents($filepath, false, null, 0, 8192); // Check first 8KB
        
        // PHP opening tags
        $php_patterns = [
            '/<\?php/i',
            '/<\?=/i', 
            '/<\?[^x]/i',
            '/<script\s+language\s*=\s*["\']php["\']/i'
        ];
        
        foreach ($php_patterns as $pattern) {
            if (preg_match($pattern, $content)) {
                return true;
            }
        }
        
        // Suspicious functions
        $dangerous_functions = [
            'eval', 'exec', 'system', 'shell_exec', 'passthru',
            'file_get_contents', 'file_put_contents', 'fwrite',
            'base64_decode', 'gzinflate', 'str_rot13'
        ];
        
        foreach ($dangerous_functions as $func) {
            if (stripos($content, $func . '(') !== false) {
                return true;
            }
        }
        
        return false;
    }
    
    private function validateImage($filepath) {
        // Use getimagesize for basic validation
        $image_info = @getimagesize($filepath);
        if ($image_info === false) {
            return false;
        }
        
        // Check if it's a real image format
        $allowed_image_types = [IMAGETYPE_JPEG, IMAGETYPE_PNG];
        if (!in_array($image_info[2], $allowed_image_types)) {
            return false;
        }
        
        // Try to create image resource (catches many malformed images)
        switch ($image_info[2]) {
            case IMAGETYPE_JPEG:
                $img = @imagecreatefromjpeg($filepath);
                break;
            case IMAGETYPE_PNG:
                $img = @imagecreatefrompng($filepath);
                break;
            default:
                return false;
        }
        
        if ($img === false) {
            return false;
        }
        
        imagedestroy($img);
        return true;
    }
    
    private function validatePDF($filepath) {
        // Read first few bytes to check PDF header
        $handle = fopen($filepath, 'rb');
        $header = fread($handle, 8);
        fclose($handle);
        
        if (strpos($header, '%PDF-') !== 0) {
            return false;
        }
        
        // Check for suspicious content in PDF
        $content = file_get_contents($filepath, false, null, 0, 16384); // First 16KB
        
        $suspicious_patterns = [
            '/\/JavaScript/i',
            '/\/JS/i',
            '/\/Launch/i',
            '/\/EmbeddedFile/i',
            '/\/XFA/i'
        ];
        
        foreach ($suspicious_patterns as $pattern) {
            if (preg_match($pattern, $content)) {
                return false;
            }
        }
        
        return true;
    }
    
    private function isSecureFilename($filename) {
        // Remove path information
        $filename = basename($filename);
        
        // Check for dangerous characters
        $dangerous_chars = ['..', '/', '\\', ':', '*', '?', '"', '<', '>', '|', '\0'];
        
        foreach ($dangerous_chars as $char) {
            if (strpos($filename, $char) !== false) {
                return false;
            }
        }
        
        // Check for reserved names (Windows)
        $reserved_names = ['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'LPT1', 'LPT2'];
        $name_without_ext = pathinfo($filename, PATHINFO_FILENAME);
        
        if (in_array(strtoupper($name_without_ext), $reserved_names)) {
            return false;
        }
        
        return true;
    }
    
    private function generateSecureFilename($file) {
        $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
        $random_name = bin2hex(random_bytes(16));
        $timestamp = time();
        
        return $timestamp . '_' . $random_name . '.' . $extension;
    }
    
    private function quarantineFile($file, $reason) {
        if (!is_dir($this->quarantine_path)) {
            mkdir($this->quarantine_path, 0700, true);
        }
        
        $quarantine_filename = time() . '_' . bin2hex(random_bytes(8)) . '_suspicious';
        $quarantine_full_path = $this->quarantine_path . $quarantine_filename;
        
        move_uploaded_file($file['tmp_name'], $quarantine_full_path);
        chmod($quarantine_full_path, 0600);
        
        // Log quarantine event
        error_log("File quarantined: {$file['name']} -> $quarantine_filename. Reason: $reason");
        
        // Alert security team
        $this->alertSecurity($file, $reason, $quarantine_filename);
    }
    
    private function alertSecurity($file, $reason, $quarantine_filename) {
        $alert_data = [
            'timestamp' => date('Y-m-d H:i:s'),
            'ip_address' => $_SERVER['REMOTE_ADDR'],
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown',
            'filename' => $file['name'],
            'size' => $file['size'],
            'reason' => $reason,
            'quarantine_file' => $quarantine_filename,
            'session_id' => session_id()
        ];
        
        // Log to security log
        error_log("SECURITY ALERT: Malicious upload attempt - " . json_encode($alert_data));
        
        // You could also send email alert, webhook, etc.
        // mail('[email protected]', 'Malicious Upload Detected', json_encode($alert_data, JSON_PRETTY_PRINT));
    }
    
    private function logUpload($file, $secure_filename, $ip_address) {
        $log_entry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'ip_address' => $ip_address,
            'original_filename' => $file['name'],
            'secure_filename' => $secure_filename,
            'size' => $file['size'],
            'mime_type' => $file['type']
        ];
        
        error_log("File upload: " . json_encode($log_entry));
    }
    
    private function getUploadErrorMessage($error_code) {
        switch ($error_code) {
            case UPLOAD_ERR_INI_SIZE:
                return 'File exceeds upload_max_filesize';
            case UPLOAD_ERR_FORM_SIZE:
                return 'File exceeds MAX_FILE_SIZE';
            case UPLOAD_ERR_PARTIAL:
                return 'File was only partially uploaded';
            case UPLOAD_ERR_NO_FILE:
                return 'No file was uploaded';
            case UPLOAD_ERR_NO_TMP_DIR:
                return 'Missing temporary folder';
            case UPLOAD_ERR_CANT_WRITE:
                return 'Failed to write file to disk';
            case UPLOAD_ERR_EXTENSION:
                return 'Upload stopped by extension';
            default:
                return 'Unknown upload error';
        }
    }
}

// Usage example in WHMCS custom template
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['attachment'])) {
    $uploader = new SecureFileUpload();
    $result = $uploader->validateAndUpload($_FILES['attachment']);
    
    if ($result['success']) {
        echo "File uploaded successfully: " . $result['filename'];
    } else {
        echo "Upload failed: " . $result['error'];
        if ($result['quarantined']) {
            // Alert admin about suspicious file
            logActivity("Suspicious file upload quarantined from IP: " . $_SERVER['REMOTE_ADDR']);
        }
    }
}
?>

<?php
/**
 * Enterprise Session Security for WHMCS
 * Prevents session hijacking, fixation, and cookie theft
 */

class SecureSessionManager {
    
    private $session_timeout = 1800; // 30 minutes
    private $regenerate_interval = 300; // 5 minutes
    private $max_concurrent_sessions = 2;
    
    public function __construct() {
        $this->configureSecureSession();
        $this->startSecureSession();
    }
    
    private function configureSecureSession() {
        // Secure session configuration
        ini_set('session.cookie_httponly', 1);     // Prevent JavaScript access
        ini_set('session.cookie_secure', 1);       // HTTPS only
        ini_set('session.cookie_samesite', 'Strict'); // CSRF protection
        ini_set('session.use_strict_mode', 1);     // Reject uninitialized session IDs
        ini_set('session.sid_length', 48);         // Longer session IDs
        ini_set('session.sid_bits_per_character', 6); // More entropy
        
        // Custom session name
        session_name('WHMCS_ADMIN_' . hash('sha256', $_SERVER['SERVER_NAME']));
        
        // Secure session save path
        $session_path = '/secure/sessions';
        if (!is_dir($session_path)) {
            mkdir($session_path, 0700, true);
        }
        session_save_path($session_path);
    }
    
    private function startSecureSession() {
        session_start();
        
        // First-time session setup
        if (!isset($_SESSION['initiated'])) {
            $this->initializeSession();
        }
        
        // Validate existing session
        if (!$this->validateSession()) {
            $this->destroySession();
            $this->initializeSession();
        }
        
        // Regenerate session ID periodically
        if ($this->shouldRegenerateSessionId()) {
            $this->regenerateSessionId();
        }
        
        // Update activity timestamp
        $_SESSION['last_activity'] = time();
    }
    
    private function initializeSession() {
        session_regenerate_id(true);
        
        $_SESSION['initiated'] = true;
        $_SESSION['created'] = time();
        $_SESSION['last_activity'] = time();
        $_SESSION['last_regeneration'] = time();
        $_SESSION['user_agent_hash'] = $this->getUserAgentHash();
        $_SESSION['ip_address'] = $this->getClientIP();
        $_SESSION['fingerprint'] = $this->generateFingerprint();
        
        // Log session creation
        $this->logSecurityEvent('session_created', [
            'session_id' => session_id(),
            'ip_address' => $_SESSION['ip_address'],
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown'
        ]);
    }
    
    private function validateSession() {
        // Check session timeout
        if (isset($_SESSION['last_activity']) && 
            (time() - $_SESSION['last_activity']) > $this->session_timeout) {
            
            $this->logSecurityEvent('session_timeout', [
                'session_id' => session_id(),
                'last_activity' => $_SESSION['last_activity'],
                'timeout_duration' => $this->session_timeout
            ]);
            
            return false;
        }
        
        // Validate user agent (detect session hijacking)
        if (isset($_SESSION['user_agent_hash']) && 
            $_SESSION['user_agent_hash'] !== $this->getUserAgentHash()) {
            
            $this->logSecurityEvent('session_hijack_attempt', [
                'session_id' => session_id(),
                'expected_agent' => $_SESSION['user_agent_hash'],
                'actual_agent' => $this->getUserAgentHash(),
                'ip_address' => $this->getClientIP()
            ]);
            
            return false;
        }
        
        // Validate IP address (optional - can cause issues with load balancers)
        if (isset($_SESSION['ip_address']) && STRICT_IP_VALIDATION) {
            $current_ip = $this->getClientIP();
            if ($_SESSION['ip_address'] !== $current_ip) {
                
                $this->logSecurityEvent('session_ip_change', [
                    'session_id' => session_id(),
                    'original_ip' => $_SESSION['ip_address'],
                    'current_ip' => $current_ip
                ]);
                
                // For high security environments, you might want to invalidate
                // For normal use, just log and update
                $_SESSION['ip_address'] = $current_ip;
            }
        }
        
        // Validate browser fingerprint
        if (isset($_SESSION['fingerprint']) && 
            $_SESSION['fingerprint'] !== $this->generateFingerprint()) {
            
            $this->logSecurityEvent('session_fingerprint_mismatch', [
                'session_id' => session_id(),
                'expected_fingerprint' => $_SESSION['fingerprint'],
                'actual_fingerprint' => $this->generateFingerprint()
            ]);
            
            // Fingerprint changes can be legitimate (browser updates, etc.)
            // So we log but don't necessarily invalidate
        }
        
        return true;
    }
    
    private function shouldRegenerateSessionId() {
        return isset($_SESSION['last_regeneration']) && 
               (time() - $_SESSION['last_regeneration']) > $this->regenerate_interval;
    }
    
    private function regenerateSessionId() {
        $old_session_id = session_id();
        
        session_regenerate_id(true);
        $_SESSION['last_regeneration'] = time();
        
        $this->logSecurityEvent('session_regenerated', [
            'old_session_id' => $old_session_id,
            'new_session_id' => session_id()
        ]);
    }
    
    public function destroySession() {
        $this->logSecurityEvent('session_destroyed', [
            'session_id' => session_id(),
            'reason' => 'Security validation failed'
        ]);
        
        // Clear session data
        $_SESSION = array();
        
        // Delete session cookie
        if (isset($_COOKIE[session_name()])) {
            setcookie(session_name(), '', time()-3600, '/', '', true, true);
        }
        
        // Destroy session
        session_destroy();
    }
    
    public function loginUser($admin_id, $admin_username) {
        // Check concurrent sessions
        if (!$this->checkConcurrentSessions($admin_id)) {
            throw new Exception("Maximum concurrent sessions exceeded");
        }
        
        // Set login data
        $_SESSION['admin_id'] = $admin_id;
        $_SESSION['admin_username'] = $admin_username;
        $_SESSION['login_time'] = time();
        $_SESSION['privilege_escalation'] = false;
        
        // Generate CSRF token
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        
        // Log successful login
        $this->logSecurityEvent('admin_login', [
            'admin_id' => $admin_id,
            'admin_username' => $admin_username,
            'session_id' => session_id(),
            'ip_address' => $this->getClientIP()
        ]);
        
        // Store session info in database for concurrent session tracking
        $this->storeSessionInfo($admin_id);
    }
    
    public function logoutUser() {
        if (isset($_SESSION['admin_id'])) {
            $this->logSecurityEvent('admin_logout', [
                'admin_id' => $_SESSION['admin_id'],
                'session_duration' => time() - $_SESSION['login_time']
            ]);
            
            // Remove from active sessions
            $this->removeSessionInfo($_SESSION['admin_id'], session_id());
        }
        
        $this->destroySession();
    }
    
    public function requireValidSession() {
        if (!isset($_SESSION['admin_id']) || empty($_SESSION['admin_id'])) {
            $this->redirectToLogin();
        }
        
        // Check if admin account is still active
        if (!$this->isAdminAccountActive($_SESSION['admin_id'])) {
            $this->logSecurityEvent('inactive_admin_access_attempt', [
                'admin_id' => $_SESSION['admin_id']
            ]);
            $this->logoutUser();
        }
    }
    
    public function generateCSRFToken() {
        if (!isset($_SESSION['csrf_token'])) {
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
        }
        return $_SESSION['csrf_token'];
    }
    
    public function validateCSRFToken($token) {
        return isset($_SESSION['csrf_token']) && 
               hash_equals($_SESSION['csrf_token'], $token);
    }
    
    private function getUserAgentHash() {
        $user_agent = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown';
        return hash('sha256', $user_agent);
    }
    
    private function getClientIP() {
        // Handle various proxy configurations
        $ip_keys = ['HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'HTTP_CLIENT_IP', 'REMOTE_ADDR'];
        
        foreach ($ip_keys as $key) {
            if (!empty($_SERVER[$key])) {
                $ip = $_SERVER[$key];
                // Handle comma-separated IPs (X-Forwarded-For)
                if (strpos($ip, ',') !== false) {
                    $ip = trim(explode(',', $ip)[0]);
                }
                
                // Validate IP
                if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                    return $ip;
                }
            }
        }
        
        return $_SERVER['REMOTE_ADDR'] ?? 'unknown';
    }
    
    private function generateFingerprint() {
        $components = [
            $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '',
            $_SERVER['HTTP_ACCEPT_ENCODING'] ?? '',
            $_SERVER['HTTP_ACCEPT'] ?? ''
        ];
        
        return hash('sha256', implode('|', $components));
    }
    
    private function checkConcurrentSessions($admin_id) {
        try {
            $pdo = \WHMCS\Database\Capsule::connection()->getPdo();
            
            $stmt = $pdo->prepare("
                SELECT COUNT(*) FROM admin_sessions 
                WHERE admin_id = ? AND last_activity > ?
            ");
            
            $cutoff_time = time() - $this->session_timeout;
            $stmt->execute([$admin_id, $cutoff_time]);
            
            $active_sessions = $stmt->fetchColumn();
            
            return $active_sessions < $this->max_concurrent_sessions;
            
        } catch (Exception $e) {
            error_log("Error checking concurrent sessions: " . $e->getMessage());
            return true; // Allow login if we can't check
        }
    }
    
    private function storeSessionInfo($admin_id) {
        try {
            $pdo = \WHMCS\Database\Capsule::connection()->getPdo();
            
            // Clean up old sessions first
            $stmt = $pdo->prepare("
                DELETE FROM admin_sessions 
                WHERE last_activity < ?
            ");
            $stmt->execute([time() - $this->session_timeout]);
            
            // Insert current session
            $stmt = $pdo->prepare("
                INSERT INTO admin_sessions 
                (session_id, admin_id, ip_address, user_agent, created_at, last_activity)
                VALUES (?, ?, ?, ?, ?, ?)
                ON DUPLICATE KEY UPDATE last_activity = VALUES(last_activity)
            ");
            
            $stmt->execute([
                session_id(),
                $admin_id,
                $this->getClientIP(),
                $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown',
                time(),
                time()
            ]);
            
        } catch (Exception $e) {
            error_log("Error storing session info: " . $e->getMessage());
        }
    }
    
    private function removeSessionInfo($admin_id, $session_id) {
        try {
            $pdo = \WHMCS\Database\Capsule::connection()->getPdo();
            
            $stmt = $pdo->prepare("
                DELETE FROM admin_sessions 
                WHERE admin_id = ? AND session_id = ?
            ");
            $stmt->execute([$admin_id, $session_id]);
            
        } catch (Exception $e) {
            error_log("Error removing session info: " . $e->getMessage());
        }
    }
    
    private function isAdminAccountActive($admin_id) {
        try {
            $pdo = \WHMCS\Database\Capsule::connection()->getPdo();
            
            $stmt = $pdo->prepare("
                SELECT disabled FROM tbladmins WHERE id = ?
            ");
            $stmt->execute([$admin_id]);
            
            $result = $stmt->fetch();
            return $result && !$result['disabled'];
            
        } catch (Exception $e) {
            error_log("Error checking admin status: " . $e->getMessage());
            return false;
        }
    }
    
    private function logSecurityEvent($event_type, $data) {
        $log_entry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'event_type' => $event_type,
            'data' => $data
        ];
        
        error_log("SECURITY: " . json_encode($log_entry));
        
        // You might also want to store in database for analysis
        // $this->storeSecurityLog($event_type, $data);
    }
    
    private function redirectToLogin() {
        $login_url = '/admin/login.php';
        if (headers_sent()) {
            echo '<script>window.location.href="' . $login_url . '";</script>';
        } else {
            header('Location: ' . $login_url);
        }
        exit;
    }
}

// Usage in WHMCS admin pages
$session_manager = new SecureSessionManager();

// For login page
if ($login_successful) {
    $session_manager->loginUser($admin_id, $admin_username);
}

// For admin pages
$session_manager->requireValidSession();

// For forms (CSRF protection)
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!$session_manager->validateCSRFToken($_POST['csrf_token'] ?? '')) {
        die('CSRF token validation failed');
    }
}

// Include in forms:
// <input type="hidden" name="csrf_token" value="<?php echo $session_manager->generateCSRFToken(); ?>">

/*
CREATE TABLE admin_sessions (
    session_id VARCHAR(128) PRIMARY KEY,
    admin_id INT NOT NULL,
    ip_address VARCHAR(45) NOT NULL,
    user_agent TEXT,
    created_at INT NOT NULL,
    last_activity INT NOT NULL,
    INDEX idx_admin_activity (admin_id, last_activity)
);
*/
?>