PT-2006-1852 · Php Nuke · Php-Nuke

Janek Vind + 1 · Published 2006-02-21 · Updated 2018-10-18 · CVE-2006-0805

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions php-Nuke versions 6.0 through 7.9

Description The issue concerns the CAPTCHA functionality, which uses fixed challenge/response pairs. These pairs only change once per day and are based on the User Agent (HTTP USER AGENT). This allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, and then replaying that pair in the random num and gfx check parameters.

Recommendations For php-Nuke versions 6.0 through 7.9, consider disabling the CAPTCHA functionality until a patch is available, or restrict access to sensitive areas protected by CAPTCHA to minimize the risk of exploitation. Avoid using the random num and gfx check parameters in affected CAPTCHA challenges until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0805

Affected Products

Php-Nuke

References · 8

• 🔥 http://waraxe.us/advisory-45.html · Exploit
• 🔥 http://securityfocus.com/bid/16722 · Exploit
• 🔥 https://exploit-db.com/exploits/27249 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0805 · Security Note
• http://securityreason.com/securityalert/455 · Note
• http://securityfocus.com/archive/1/425394/100/0/threaded · Note
• http://secunia.com/advisories/18936 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0805 · Note