CVE-2008-2020

Published: Apr 30, 2008Modified: Apr 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a code_bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.

Affected (9)

Products: E107: E107 · Labgab: Labgab · My123tkshop: E Commerce Suite · +5 more

Show all products

E107: E107 · Labgab: Labgab · My123tkshop: E Commerce Suite · Opendb: Opendb · Phpmybittorrent: Phpmybittorrent · Phpnuke: Php Nuke · Torrentflux Project: Torrentflux · Webze: Webze

1 product

1 product

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
E107 E107	Version 0.7.11
Labgab Labgab	Version 1.1
My123tkshop E Commerce Suite	Version 0.9.1
Opendb Opendb	Version 1.5.0 beta4
Phpmybittorrent Phpmybittorrent	Version 1.2.2
Phpnuke Php Nuke	Version 7.0
Phpnuke Php Nuke	Version 8.1
Torrentflux Project Torrentflux	Version 2.3
Webze Webze	Version 0.5.9