bugtraq - ShAnKaR: Simle machines forum CAPTCHA bypass and PHP injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1844668996.20070618134953@SECURITY.NNOV.RU>
Date: Mon, 18 Jun 2007 13:49:53 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: ShAnKaR: Simle machines forum CAPTCHA bypass and PHP injection

Dear bugtraq@...urityfocus.com,

  ShAnKaR  <shankar  at shankar.name> reported vulnerabilities in Simple
  Machines Forum 1.1.2 (aka SMF) http://www.simplemachines.org/

  Original advisory (in Russian):
  http://securityvulns.ru/Rdocument271.html

1. Weak sound-based CAPTCHA protection

   In  this engine sound CAPTCHA based automated registration protection
   is  implemented  with  a  WAV file, generated by concatenation of few
   different  sound  files.  Developers  use WAV file randomization, but
   this   randomization   is   insufficient   and  can  be  bypassed  by
   bruteforcing with known sound templates.

[blah@...alhost smfh]$ ./captcha.pl http://localhost/smf/
nnrbv
created in 1.41827201843262 seconds
[andrey@...alhost smfh]$ ./captcha.pl http://localhost/smf/
vpubu
created in 1.49515509605408 seconds
[andrey@...alhost smfh]$ ./captcha.pl http://localhost/smf/
ntfhh
created in 2.31928586959839 seconds
[andrey@...alhost smfh]$ ./captcha.pl http://localhost/smf/
egudz
created in 0.823321104049683 seconds

  As  it  can  be  seen,  bruteforce usually takes only 1-2 seconds. See
  script attached.

2. PHP injection

There  is  a  possibility  to  execute  any  PHP code during creation or
editing of forum message.
(no further details is given by advisory author).

-- 
http://securityvulns.com/
         /\_/\
        { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
                    |/
Download attachment "capcha.pl" of type "application/octet-stream" (23006 bytes)