Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 09 Aug 2015 15:50:10 -0400
From: François Labrèche <>
CC: Olivier Bilodeau <>
Subject: CVE request - simple-php-captcha - captcha bypass vulnerability


We found a captcha bypass vulnerability in an open source captcha 
software, made by Cory LaViska for A Beautiful Site. Here is the github 

We opened an issue on github 
<>, and the 
vulnerability has been fixed. They never did any release so we don't 
think the fix will be released in any form. Simply advising users to 
update to git master's should suffice.

The simple-php-captcha.php file had a vulnerability enabling a client to 
generate the captcha response automatically, effectively bypassing the 

Since the microtime() function was used both in the initial seed for the 
captcha and in the captcha url path sent to the client, it was possible 
to generate the captcha result automatically by running the same code 

Could a CVE be assigned to this?

Thank you,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.