PT-2008-3540 · Torrentflux+7 · Torrentflux+7

Michael Brooks · Published 2008-04-30 · Updated 2024-02-14 · CVE-2008-2020

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Francisco Burzi PHP-Nuke versions 7.0 through 8.1 my123tkShop e-Commerce-Suite version 0.9.1 phpMyBitTorrent version 1.2.2 TorrentFlux version 2.3 e107 version 0.7.11 WebZE version 0.5.9 Open Media Collectors Database version 1.5.0b4 Labgab version 1.1

Description The CAPTCHA implementation uses a code bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images. This allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.

Recommendations For Francisco Burzi PHP-Nuke versions 7.0 through 8.1, consider implementing a more secure CAPTCHA system that produces a sufficient number of different images. For my123tkShop e-Commerce-Suite version 0.9.1, restrict access to sensitive areas of the application until a more secure CAPTCHA system is implemented. For phpMyBitTorrent version 1.2.2, disable the CAPTCHA test until a patch is available that addresses the issue. For TorrentFlux version 2.3, avoid using the ImageString function for CAPTCHA generation until a more secure alternative is available. For e107 version 0.7.11, consider using a different CAPTCHA implementation that is not vulnerable to automated attacks. For WebZE version 0.5.9, restrict access to the CAPTCHA-protected areas of the application until a more secure CAPTCHA system is implemented. For Open Media Collectors Database version 1.5.0b4, disable the CAPTCHA test until a patch is available that addresses the issue. For Labgab version 1.1, consider implementing a more secure CAPTCHA system that produces a sufficient number of different images.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2008-2020

Affected Products

Labgab

Open Media Collectors Database

Php-Nuke

Torrentflux

Webze

E107

My123Tkshop E-Commerce-Suite

Phpmybittorrent

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-2020 · Security Note
• http://rooksecurity.com/blog/?p=6 · Note
• http://securityreason.com/securityalert/3834 · Note
• http://securityfocus.com/bid/28877 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2020 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42152 · Note
• http://securityfocus.com/archive/1/491127/100/0/threaded · Note