CVE-2008-2020

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-30 · updated 2026-06-16
Weakness: CWE-330

Description

The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux 2.3, (5) e107 0.7.11, (6) WebZE 0.5.9, (7) Open Media Collectors Database (aka OpenDb) 1.5.0b4, and (8) Labgab 1.1 uses a code_bg.jpg background image and the PHP ImageString function in a way that produces an insufficient number of different images, which allows remote attackers to pass the CAPTCHA test via an automated attack using a table of all possible image checksums and their corresponding digit strings.

Affected products

e107 CMS: 0.7.11
Labgab: 1.1
My123Tkshop E-Commerce-Suite: 0.9.1
Opendb: 1.5.0-beta4
Phpmybittorrent: 1.2.2
Phpnuke Php-Nuke: 7.0, 8.1
Torrentflux Project Torrentflux: 2.3
Webze: 0.5.9

References

http://securityreason.com/securityalert/3834
http://www.rooksecurity.com/blog/?p=6
http://www.securityfocus.com/archive/1/491127/100/0/threaded
http://www.securityfocus.com/bid/28877
https://exchange.xforce.ibmcloud.com/vulnerabilities/42152
http://securityreason.com/securityalert/3834
http://www.rooksecurity.com/blog/?p=6
http://www.securityfocus.com/archive/1/491127/100/0/threaded
http://www.securityfocus.com/bid/28877
https://exchange.xforce.ibmcloud.com/vulnerabilities/42152

Get alerted when CVE-2008-2020 or the next vulnerability affects your stack