Hello Bugtraq! I want to warn you about Insufficient Anti-automation and Denial of Service vulnerabilities in multiple systems. It's additional information to my advisories about MiniManager for Project MANGOS and HoloCMS. I have reported already about Insufficient Anti-automation and Denial of Service vulnerabilities in CaptchaSecurityImages and in many systems which are using script CaptchaSecurityImages.php. And about vulnerabilities in some other systems (which already disclosed at my site) I'll write to the list soon, when the queue will come to them. As I mentioned before, there are many vulnerable web sites and web applications with CaptchaSecurityImages.php. And as you can see from all my advisories on this subject, there are really many vulnerable CMS with it. But it's just only those which I found in one Google dork, and there can be a lot of other systems which are using the same vulnerable CaptchaSecurityImages.php. E.g. those which not indexed by Google, open source systems which have no online SVN, commercial systems (as open source, as closed source which decided to use this GPL script) and those systems, which changed filename of CaptchaSecurityImages.php. So I made additional research on vulnerable systems previously reported by me, and found many projects which are also affected. Here is a list of them as an addition to my two previous advisories. I already combined information about vulnerabilities in GunCMS and PhoenixCMS PHP Edition into one advisory, and in this advisory I'm using the same approach. Where I combine multiple vulnerable systems into one advisory not by just using of the same script, but when they use codes of other systems. Concerning vulnerabilities in MiniManager for Project MANGOS (http://websecurity.com.ua/4061/): - Land of Legends Manager (LoL Manager) based on MiniManager for Project MANGOS (there is mentioning of CaptchaSecurityImages.php in code of the system, but in SVN there is no the file itself). - WoWCrackz MaNGOS based on MiniManager for Project MANGOS (only the path to CaptchaSecurityImages.php is different). Resulting list of affected software: Affected products: MiniManager for Project MANGOS 0.15 and previous versions, Land of Legends Manager, WoWCrackz MaNGOS. Concerning vulnerabilities in HoloCMS (http://websecurity.com.ua/4068/) and in addition to GunCMS and PhoenixCMS PHP Edition (http://websecurity.com.ua/4075/): - Baboh Emulator includes HoloCMS. - CoreCMS based on HoloCMS. - Holograph Emulator can include HoloCMS. - Holograph Emulator - Craigs Edition includes CoreCMS. - 0niCMS based on HoloCMS. - AJ-CMS it's new version of HoloCMS. - HoloCMS v3.2.0 Synergy it's new version of HoloCMS. - HoloCMSrW it's other version of HoloCMS. - Mir it's new version of HoloCMS. - Alexx Hotel includes HoloCMS. In most cases (except few ones) I have not succeed in viewing source codes of these CMS and in checking of existence in them of vulnerabilities from HoloCMS (due to lack of such codes in online SVN). But taking into account that all these projects use old vulnerable code of HoloCMS, then with no doubts they all are vulnerable. Resulting list of affected software: Affected products: HoloCMS 1.3.1, 3.1 and previous versions, GunCMS, PhoenixCMS PHP Edition, Baboh Emulator, CoreCMS, Holograph Emulator, Holograph Emulator - Craigs Edition, 0niCMS, AJ-CMS, HoloCMS v3.2.0 Synergy, HoloCMSrW, Mir, Alexx Hotel. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
