Re: CVE request - simple-php-captcha - captcha bypass vulnerability

[Solar Designer <solar () openwall com>]

On Mon, Aug 17, 2015 at 01:55:48PM -0400, cve-assign () mitre org wrote:
> > https://github.com/claviska/simple-php-captcha/issues/16
>
> Use CVE-2015-6250 for the original issue that the "srand(microtime() *
> 100)" call is counterproductive because, especially in cases of good
> time synchronization, the client is able to run the same srand call as
> the server.

FWIW, time synchronization was irrelevant.  The original report said:

"Since microtime() is used both in the initial seed for the captcha and
in the captcha url path sent to the client, [...]"

This is referring to:

$image_src = substr(__FILE__, strlen( realpath($_SERVER['DOCUMENT_ROOT']) )) . '?_CAPTCHA&t=' . 
urlencode(microtime());

Alexander