Date: Sun, 09 Aug 2015 15:50:10 -0400 From: François Labrèche <f.labreche@...il.com> To: oss-security@...ts.openwall.com CC: Olivier Bilodeau <olivier@...tomlesspit.org> Subject: CVE request - simple-php-captcha - captcha bypass vulnerability Hi, We found a captcha bypass vulnerability in an open source captcha software, made by Cory LaViska for A Beautiful Site. Here is the github repository: https://github.com/claviska/simple-php-captcha. We opened an issue on github <https://github.com/claviska/simple-php-captcha/issues/16>, and the vulnerability has been fixed. They never did any release so we don't think the fix will be released in any form. Simply advising users to update to git master's should suffice. The simple-php-captcha.php file had a vulnerability enabling a client to generate the captcha response automatically, effectively bypassing the captcha. Since the microtime() function was used both in the initial seed for the captcha and in the captcha url path sent to the client, it was possible to generate the captcha result automatically by running the same code client-side. Could a CVE be assigned to this? Thank you, François
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ