Hello Bugtraq!
I want to warn you about Insufficient Anti-automation and Denial of Service
vulnerabilities in multiple systems.
It's additional information to my advisories about MiniManager for Project
MANGOS and HoloCMS.
I have reported already about Insufficient Anti-automation and Denial of
Service vulnerabilities in CaptchaSecurityImages and in many systems which
are using script CaptchaSecurityImages.php. And about vulnerabilities in
some other systems (which already disclosed at my site) I'll write to the
list soon, when the queue will come to them.
As I mentioned before, there are many vulnerable web sites and web
applications with CaptchaSecurityImages.php. And as you
can see from all my advisories on this subject, there are really many
vulnerable CMS with it. But it's just only those which I found in one
Google dork, and there can be a lot of other systems which are using the
same vulnerable CaptchaSecurityImages.php. E.g. those which not indexed by
Google, open source systems which have no online SVN, commercial systems (as
open source, as closed source which decided to use this GPL script) and
those systems, which changed filename of CaptchaSecurityImages.php.
So I made additional research on vulnerable systems previously reported by
me, and found many projects which are also affected. Here is a list of them
as an addition to my two previous advisories. I already combined information
about vulnerabilities in GunCMS and PhoenixCMS PHP Edition into one
advisory, and in this advisory I'm using the same approach. Where I combine
multiple vulnerable systems into one advisory not by just using of the same
script, but when they use codes of other systems.
Concerning vulnerabilities in MiniManager for Project MANGOS
(http://websecurity.com.ua/4061/):
Resulting list of affected software:
Affected products: MiniManager for Project MANGOS 0.15 and previous
versions, Land of Legends Manager, WoWCrackz MaNGOS.
Concerning vulnerabilities in HoloCMS (http://websecurity.com.ua/4068/) and
in addition to GunCMS and PhoenixCMS PHP Edition
(http://websecurity.com.ua/4075/):
In most cases (except few ones) I have not succeed in viewing source codes
of these CMS and in checking of existence in them of vulnerabilities from
HoloCMS (due to lack of such codes in online SVN). But taking into account
that all these projects use old vulnerable code of HoloCMS, then with no
doubts they all are vulnerable.
Resulting list of affected software:
Affected products: HoloCMS 1.3.1, 3.1 and previous versions, GunCMS,
PhoenixCMS PHP Edition, Baboh Emulator, CoreCMS, Holograph Emulator,
Holograph Emulator - Craigs Edition, 0niCMS, AJ-CMS, HoloCMS v3.2.0 Synergy,
HoloCMSrW, Mir, Alexx Hotel.
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua