medium5.0Public exploit code
CVE-2008-3573
The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pligg CMS 9.9.5 - 'CAPTCHA' Registration Automation Security Bypass2008-08-02 · webapps · php · Verified
Impact
The CAPTCHA implementation in (1) Pligg 9.9.5 and possibly (2) Francisco Burzi PHP-Nuke 8.1 provides a critical random number (the ts_random value) within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value with the current date and the HTTP User-Agent string.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php-Nuke | Php-Nuke | Version 8.1 |
| Pligg | Pligg | Version 9.9.5 |