← Advisories

Securimage 3.5 URI-based Cross-Site Scripting Vulnerability

Medium

Advisory ID

ZSL-2013-5139

Release Date

10 May 2013

Vendor

Securimage PHP CAPTCHA - http://www.phpcaptcha.org

Affected Version

3.5

CVE

N/A

Tested On

Apache, PHP 5.3.6

Summary

Securimage is an open-source free PHP CAPTCHA script for generating complex images and CAPTCHA codes to protect forms from spam and abuse.

Description

Securimage suffers from a XSS issue in 'example_form.php' that uses the 'REQUEST_URI' variable. The vulnerability is present because there isn't any filtering to the mentioned variable in the affected script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

/example_form.php:
-------------------------

47: <form method="post" action="<?php echo $_SERVER['REQUEST_URI'] . $_SERVER['QUERY_STRING'] ?>" id="contact_form">

Proof of Concept

securimage_xss.txtTXT

Disclosure Timeline

21.04.2013Vulnerability discovered.

23.04.2013Contact with the vendor.

23.04.2013Vendor replies asking more details.

23.04.2013Sent detailed information to the vendor.

24.04.2013Working with the vendor.

30.04.2013Asked vendor for status update.

09.05.2013No reply from the vendor.

10.05.2013Public security advisory released.

15.02.2014Vendor releases version 3.5.1 to address this issue.