Re: Vulnerabilities in phpCOIN

["Jan G.B." <ro0ot.w00t () googlemail com>]

2010/4/9 MustLive <mustlive () websecurity com ua>:
> Hello Full-Disclosure!

Quoting the list charter: "Gratuitous advertisement, product
placement, or self-promotion is forbidden."

And where's the point in reporting several projects that use a -say-
library which has a reported problem? (I mean, you've send quite the
same mail with a different software to bugtraq, today.)

The whole point of your "advisories" is self promotion and promotion
of your website.





> I want to warn you about security vulnerabilities in system phpCOIN.
>
> -----------------------------
> Advisory: Vulnerabilities in phpCOIN
> -----------------------------
> URL: http://websecurity.com.ua/4090/
> -----------------------------
> Affected products: phpCOIN 1.6.5 and previous versions.
> -----------------------------
> Timeline:
> 17.03.2010 - found vulnerabilities.
> 01.04.2010 - disclosed at my site.
> 02.04.2010 - informed developers.
> -----------------------------
> Details:
>
> These are Insufficient Anti-automation and Denial of Service
> vulnerabilities.
>
> The vulnerabilities exist in captcha script CaptchaSecurityImages.php, which
> is using in this system. I already reported about vulnerabilities in
> CaptchaSecurityImages (http://websecurity.com.ua/4043/).
>
> Insufficient Anti-automation:
>
> http://site/coin_addons/captcha/CaptchaSecurityImages.php?width=150&height=100&characters=2
>
> Captcha bypass is possible via half-automated or automated (with using of
> OCR) methods, which were mentioned before (http://websecurity.com.ua/4043/).
>
> DoS:
>
> http://site/coin_addons/captcha/CaptchaSecurityImages.php?width=1000&height=9000
>
> With setting of large values of width and height it's possible to create
> large load at the server.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/