Hello Bugtraq! I want to warn you about security vulnerabilities in TAK cms. It's Ukrainian commercial CMS. ----------------------------- Advisory: Vulnerabilities in TAK cms ----------------------------- URL: http://websecurity.com.ua/4050/ ----------------------------- Timeline: 04.02.2009 - found vulnerabilities. 30.09.2009 - informed owners of web sites where I found these vulnerabilities. Taking into account, that I didn't find any contact data of developer of TAK cms, then I hope, that owners of that site informed him about these vulnerabilities. This is one of those cases with commercial CMS, where developers didn't leave any contact data and there is no information about them in Internet. 19.03.2010 - disclosed at my site. ----------------------------- Details: These are Insufficient Anti-automation and Brute Force vulnerabilities. Insufficient Anti-automation: http://site/about/contacts/ http://site/register/getpassword/ At these pages there is not protection from automated requests (captcha). Brute Force: http://site/auth/ http://site/admin/ In login forms there is no protection from Brute Force attacks. Vulnerable are all versions of TAK cms. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
