PT-2023-9869 · Jianlinwei · Cool-Php-Captcha

Jianlinwei · Publicado 2023-01-13 · Atualizado 2024-05-17 · CVE-2009-10001

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions jianlinwei cool-php-captcha versions up to 0.2

Description A problematic vulnerability was found in the example-form.php file, where the manipulation of the captcha argument with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations Upgrading to version 0.3 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting the input for the captcha argument to prevent cross-site scripting attacks.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-10001

Produtos afetados

Cool-Php-Captcha

Referências · 8

• 🔥 https://github.com/jianlinwei/cool-php-captcha/issues/2 · Exploit
• 🔥 https://vuldb.com/?ctiid.218296 · Exploit
• 🔥 https://vuldb.com/?id.218296 · Exploit
• https://github.com/jianlinwei/cool-php-captcha/releases/tag/0.3 · Correção
• https://t.me/cvenotify/41964 · Publicação no Telegram
• https://t.me/cibsecurity/56490 · Publicação no Telegram
• https://github.com/jianlinwei/cool-php-captcha/commit/c84fb6b153bebaf228feee0cbf50728d27ae3f80 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-10001 · Nota de Segurança