Pligg Auto-Voter Using XSS to Bypass CSRF Protection

Explanation: Pligg Suffers from a Reflective Cross Site Scripting vulnerability in index.php. For the $GET'category' variable. Exploit code was written that uses this flaw to bypass the CSRF protection to then vote on any pligg article of the attackers choosing. I took inspiration from the Myspac...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. RavenNuke: CAPTCHA bypass...

Insufficient Anti-automation vulnerability in RavenNuke

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Insufficient Anti-automation уязвимости в RavenNuke порте PHP-Nuke. Insufficient Anti-Automation: Уязвимость в капче системы. Эксплоит: http://websecurity.com.ua/uploads/2008/RavenNuke20CAPTCHA20bypass.html Уязвима версия RavenNuke 2.20.01 и...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. SLAED CMS: CAPTCHA bypass, crossite scripting...

Cross-Site Scripting vulnerabilities in PHP-Nuke

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в PHP-Nuke. XSS: POST запрос на странице http://site/modules.php?name=YourAccount&op=newuser "script src=http://site/script.js В полях: gfxcheck и randomnum. Эксплоит:...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the 1 GLOBALSBIGACEDIRaddon parameter to a addon/smarty/plugins/function.captcha.php and b system/classes/sql/AdoDBConnection.php; a...

adv94-K-159-2008.txt

ECHOADV94$2008 ----------------------------------------------------------------------------------------- ECHOADV94$2008 Kmita Mail = 3.0 file Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran Addahroni...

Design/Logic Flaw

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

Design/Logic Flaw

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2008-2019

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2008-2020

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

CVE-2008-2019

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2008-2020

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

CVE-2008-2020

The CVE-2008-2020 issue affects multiple CAPTCHA implementations: PHP-Nuke (versions 7.0–8.1), my123tkShop 0.9.1, phpMyBitTorrent 1.2.2, TorrentFlux 2.3, e107 0.7.11, WebZE 0.5.9, Open Media Collectors Database 1.5.0b4, and Labgab 1.1. The root cause is use of a code_bg.jpg background with PHP Im...

CVE-2008-2019

SMF (likely version ~1.1.4) is vulnerable due to a weak WAV CAPTCHA generation that relies on insufficient randomness, allowing automated brute-force bypass of the CAPTCHA. Root cause points to an insufficient fix for CVE-2007-3308; exploitation status and exact patch details are not provided in ...

CVE-2008-2019: Undefined Security Weakness

Simple Machines Forum SMF, probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file aka audio CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists...

CVE-2008-2020: Use of Insufficiently Random Values

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

SMF 1.1.4 - Audio CAPTCHA Security Bypass

SMF 1.1.4 - Audio CAPTCHA Security Bypass source: https://www.securityfocus.com/bid/28866/info SMF Simple Machine Forum is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol. Successfully exploiting this issue may allow attackers to send unsolicited spam or perform...

Deciphering the PHP-Nuke Capthca

The Capthca used in the current version 8.1 of PHP Nuke can be deciphered with 100 accuracy. more information can be found her: http://www.rooksecurity.com/blog/?p=6 Exploit Code: http://www.rooksecurity.com/exploits/phpnukecaptcha.zip What is so interesting about this captcha is that it is...

Deciphering the Simple Machines Forum audio Captcha

The Simple Machine’s Forum audio Captcha that has been hardened from attack. I have contacted SMF about this flaw and it has been verified. I go into greater detail of how i am able to break this captcha here: http://www.rooksecurity.com/blog/?p=6 Exploit Code:...