TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	31370
Class:	Input Validation Error
CVE:	CVE-2008-5995
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Frank Ruske
Vulnerable:	Stanislas Rolland freeCap CAPTCHA 1.0.3
Not Vulnerable:	Stanislas Rolland freeCap CAPTCHA 1.0.4

TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability

freeCap CAPTCHA (sr_freecap) for TYPO3 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to freeCap CAPTCHA 1.0.4 are vulnerable.

TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Stanislas Rolland freeCap CAPTCHA 1.0.3

• Stanislas Rolland sr_freecap_1.0.4.t3x
  http://typo3.org/fileadmin/ter/s/r/sr_freecap_1.0.4.t3x

TYPO3 freeCap CAPTCHA Unspecified Cross Site Scripting Vulnerability

References:

• freeCap CAPTCHA Product Page (Stanisla Rolland)
  
• Cross-Site Scripting vulnerability in extension freeCap CAPTCHA (TYPO3)