PT-2023-9869 · Jianlinwei · Cool-Php-Captcha

Jianlinwei · Published 2023-01-13 · Updated 2024-05-17 · CVE-2009-10001

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions jianlinwei cool-php-captcha versions up to 0.2

Description A problematic vulnerability was found in the example-form.php file, where the manipulation of the captcha argument with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations Upgrading to version 0.3 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting the input for the captcha argument to prevent cross-site scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-10001

Affected Products

Cool-Php-Captcha

References · 8

• 🔥 https://github.com/jianlinwei/cool-php-captcha/issues/2 · Exploit
• 🔥 https://vuldb.com/?ctiid.218296 · Exploit
• 🔥 https://vuldb.com/?id.218296 · Exploit
• https://github.com/jianlinwei/cool-php-captcha/releases/tag/0.3 · Patch
• https://github.com/jianlinwei/cool-php-captcha/commit/c84fb6b153bebaf228feee0cbf50728d27ae3f80 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-10001 · Security Note
• https://t.me/cvenotify/41964 · Telegram Post
• https://t.me/cibsecurity/56490 · Telegram Post