CVEvulnerability

CVE-2008-2020

7.5 HIGH Published 2008-04-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-04-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-330

Description

The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a code_bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.

Affected configurations

• e107 e107 0.7.11 • labgab labgab 1.1 • my123tkshop e-commerce-suite 0.9.1 • opendb opendb 1.5.0 • phpmybittorrent phpmybittorrent 1.2.2 • phpnuke php-nuke 7.0 • phpnuke php-nuke 8.1 • torrentflux project torrentflux 2.3 • webze webze 0.5.9

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

Referenced by CWE · observed example (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References