CVE-2008-2020: High severity e107 cms vulnerability

Published Apr 30, 2008

Updated

The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a codebg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.

Affected Software

12 affected components

e107 e107=0.7.11

Labgab Labgab=1.1

my123tkShop e-Commerce-Suite=0.9.1

OpenDb OpenDb=1.5.0-beta4

phpMyBitTorrent phpMyBitTorrent=1.2.2

Phpnuke Php-nuke=7.0

Phpnuke Php-nuke=8.1

Torrentflux Project Torrentflux=2.3

WebZE WebZE=0.5.9

TorrentFlux TorrentFlux=2.3

PHP-Nuke PHP-Nuke=8.1

OpenDb OpenDb=1.5.0b4

Event History

Apr 30, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2020?

CVE-2008-2020 is considered a moderate severity vulnerability due to the potential bypass of CAPTCHA protections.

How do I fix CVE-2008-2020?

To fix CVE-2008-2020, update your web application to a version that patches the CAPTCHA implementation.

Which software is affected by CVE-2008-2020?

CVE-2008-2020 affects multiple software including PHP-Nuke, my123tkShop, phpMyBitTorrent, TorrentFlux, e107, WebZE, OpenDb, and Labgab.

What are the risks associated with CVE-2008-2020?

The risks associated with CVE-2008-2020 include automated attacks such as brute force and spam submissions that can exploit the CAPTCHA weakness.

When was CVE-2008-2020 reported?

CVE-2008-2020 was reported on March 18, 2008.