Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Feb 2014 07:52:29 +0100
From: Damien Cauquil <>
Subject: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities

We found two vulnerabilities in PLOGGER version 1.0RC1, including:

1. Authenticated Arbitrary file upload vulnerability affecting PLOGGER
version 1.0RC1

This vulnerability allows an authenticated user to upload an arbitrary
PHP file on the remote web server in an accessible path, by sending a
specifically crafted zip file.

2. CAPTCHA bypass vulnerability

A theme called "Lucid" provided in PLOGGER version 1.0RC1 implements a
weak CAPTCHA prone to a replay attack. By abusing this vulnerability, an
unauthenticated user may be able to post a huge number of comments.

Vendor was notified and answered this software is no more maintained.


* advisory:
* PLOGGER 1.0 RC1 release:

We would like to request 2 CVEs for these vulnerabilities.

Damien Cauquil
Directeur Recherche & DĂ©veloppement

108 avenue Gabriel PĂ©ri
93400 Saint Ouen
Tel: +33 (0) 1 78 76 58 21

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.