PHP-Nuke 'CAPTCHA' Registration Automation Multiple Security Bypass Weaknesses

Bugtraq ID:	27129
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 03 2008 12:00AM
Updated:	Jan 07 2008 05:19PM
Credit:	3APA3A is credited with the discovery of these weaknesses.
Vulnerable:	PHP-Nuke PHP-Nuke 8.0 PHP-Nuke PHP-Nuke 7.9 PHP-Nuke PHP-Nuke 7.8 PHP-Nuke PHP-Nuke 7.7 PHP-Nuke PHP-Nuke 7.6 PHP-Nuke PHP-Nuke 7.5 PHP-Nuke PHP-Nuke 7.4 PHP-Nuke PHP-Nuke 7.3 PHP-Nuke PHP-Nuke 7.2 PHP-Nuke PHP-Nuke 7.1 PHP-Nuke PHP-Nuke 7.0 PHP-Nuke PHP-Nuke 8.1 PHP-Nuke PHP-Nuke 8.0.0 Final
Not Vulnerable:

PHP-Nuke 'CAPTCHA' Registration Automation Multiple Security Bypass Weaknesses

PHP-Nuke is prone to multiple security-bypass weaknesses.

Successfully exploiting these issues will allow an attacker to register multiple new users through an automated process. This may lead to other attacks.

These issues affect PHP-Nuke 8.1; other versions may also be affected.

PHP-Nuke 'CAPTCHA' Registration Automation Multiple Security Bypass Weaknesses

Attackers can exploit these issues via a browser.

PHP-Nuke 'CAPTCHA' Registration Automation Multiple Security Bypass Weaknesses

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP-Nuke 'CAPTCHA' Registration Automation Multiple Security Bypass Weaknesses

References:

• PHP-Nuke Homepage (PHP-Nuke)
  
• multiple CAPTCHA automation test bypass digest (3APA3A <[email protected]>)