full-disclosure - Re: Vulnerabilities in phpCOIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <h2xc9a09d01004090649l434a3975xde1678c7e2d6ace2@mail.gmail.com>
Date: Fri, 9 Apr 2010 15:49:58 +0200
From: "Jan G.B." <ro0ot.w00t@...glemail.com>
To: MustLive <mustlive@...security.com.ua>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in phpCOIN

2010/4/9 MustLive <mustlive@...security.com.ua>:
> Hello Full-Disclosure!
>

Quoting the list charter: "Gratuitous advertisement, product
placement, or self-promotion is forbidden."

And where's the point in reporting several projects that use a -say-
library which has a reported problem? (I mean, you've send quite the
same mail with a different software to bugtraq, today.)

The whole point of your "advisories" is self promotion and promotion
of your website.





> I want to warn you about security vulnerabilities in system phpCOIN.
>
> -----------------------------
> Advisory: Vulnerabilities in phpCOIN
> -----------------------------
> URL: http://websecurity.com.ua/4090/
> -----------------------------
> Affected products: phpCOIN 1.6.5 and previous versions.
> -----------------------------
> Timeline:
> 17.03.2010 - found vulnerabilities.
> 01.04.2010 - disclosed at my site.
> 02.04.2010 - informed developers.
> -----------------------------
> Details:
>
> These are Insufficient Anti-automation and Denial of Service
> vulnerabilities.
>
> The vulnerabilities exist in captcha script CaptchaSecurityImages.php, which
> is using in this system. I already reported about vulnerabilities in
> CaptchaSecurityImages (http://websecurity.com.ua/4043/).
>
> Insufficient Anti-automation:
>
> http://site/coin_addons/captcha/CaptchaSecurityImages.php?width=150&height=100&characters=2
>
> Captcha bypass is possible via half-automated or automated (with using of
> OCR) methods, which were mentioned before (http://websecurity.com.ua/4043/).
>
> DoS:
>
> http://site/coin_addons/captcha/CaptchaSecurityImages.php?width=1000&height=9000
>
> With setting of large values of width and height it's possible to create
> large load at the server.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/