WHMCS remote execution

whmcs.php

<?php

class HypervisorWHMCS {

    protected $action, $params = [], $config, $error, $output = "";

    public function __construct($config) {
        $this->config = $config;
    }

    public function startListening(){
        $this->isSecure();
        $this->doAction($_POST['action'],$_POST);
    }

    protected function whmcs_decode($password){
        //Some decode function here ( not sharing mine )
        return $password;
    }

    public function isSecure(){
        if(!in_array($_SERVER['REMOTE_ADDR'],explode(",",$this->config['whitelist_ips']))){
            $this->error = "IP is not whitelisted!";
            $this->sendResponse();
        } else if(md5($this->whmcs_decode($_POST['whmcs_hash'])) !== md5($this->config['secret_hash'])){
            $this->error = "Secret hash mismatch!";
            $this->sendResponse();
        } else if(!is_string($_POST['action'])){
            $this->error = "Invalid Action!";
            $this->sendResponse();
        }
    }

    public function doAction($command = "GetClientsDetails", $params = ['clientid' => 1]){
        unset($params['whmcs_hash']);
        $output = localAPI($command, $params);
        if($output['result'] == "success"){
            $this->sendResponse($output);
        }
        $this->error = json_encode($output);
        $this->sendResponse();
    }

    public function sendResponse($data = []){
        if(!empty($this->error)){
            $this->output = ['success' => false, 'message' => $this->error];
        } else {
            $this->output = ['success' => true, 'message' => '', 'data' => $data];
        }
        print json_encode($this->output);
        exit;
    }
}
$listener = new HypervisorWHMCS([
    'whitelist_ips' => '', //eg: 127.0.0.1 or add multiple ips like 127.0.0.1,127.0.0.2,n
    'secret_hash' => '', //Your secret hash for connecting with whmcs
]);
$listener->startListening();