Captcha bypass at registration

Disclosed: 2017-06-28 02:12:30 By proabiral To weblate
Low
Vulnerability Details
### Affected URL: https://demo.weblate.org/accounts/register/ ### Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above URL captcha is simple enough that can be read by any script. An attacker can write a simple script to get value of those captcha ( as simple as `document.getElementById("div_id_captcha")` in JS ) and solve them. ### Solution: Image captcha should be implemented whose value cannot be read by script. Google captcha can be an effective solution.
Actions
View on HackerOne
Report Stats
  • Report ID: 229584
  • State: Closed
  • Substate: informative
  • Upvotes: 2
Share this report