Peter's Math Anti-Spam for WordPress Plugin Audio CAPTCHA Security Bypass Vulnerability

Bugtraq ID:	27287
Class:	Design Error
CVE:	CVE-2008-7216
Remote:	Yes
Local:	No
Published:	Jan 15 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	JosŽé M. Palazón Romero discovered this issue.
Vulnerable:	Peter�??s Useful Crap Peter's Math Anti-Spam for Wordpress 0.1.6
Not Vulnerable:

Peter's Math Anti-Spam for WordPress Plugin Audio CAPTCHA Security Bypass Vulnerability

Peter's Math Anti-Spam for WordPress is prone to a security-bypass vulnerability.

This issue occurs when presenting a visitor with challenge data to determine if they are a legitimate user or an automaton. The challenge data is poorly obfuscated and can be interpreted by script code.

Attackers can leverage this issue to bypass the security measures provided by the plugin via an automated script. This could aid in spam distribution and other attacks.

Peter's Math Anti-Spam for WordPress 0.1.6 is vulnerable; other versions may also be affected.

Peter's Math Anti-Spam for WordPress Plugin Audio CAPTCHA Security Bypass Vulnerability

Attackers can exploit this issue using a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/27287.pl

Peter's Math Anti-Spam for WordPress Plugin Audio CAPTCHA Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Peter's Math Anti-Spam for WordPress Plugin Audio CAPTCHA Security Bypass Vulnerability

References:

• Vendor Homepage (Peter's Useful Crap)
  
• Defeating audio captcha systems (JosŽé M. Palazón Romero )