CVE-2008-2020

CVE-2008-2020 describes an insufficient CAPTCHA implementation affecting multiple web applications, including PHP-Nuke, e107, and TorrentFlux. The vulnerability stems from the CAPTCHA's reliance on a limited set of background images and the PHP ImageString function, resulting in a predictable and small number of unique CAPTCHA images. This design flaw allows remote attackers to bypass the CAPTCHA through automated attacks using a precomputed table of image checksums and their corresponding digit strings. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a significant risk. It is easily exploitable over the network with low attack complexity, requiring no user interaction, and can lead to high integrity impacts by allowing automated actions typically protected by CAPTCHAs. Despite its age, there is no evidence of active exploitation, and no public exploit code is available in Metasploit or ExploitDB. However, the vulnerability has garnered considerable community discussion, with 16 mentions, suggesting ongoing awareness and interest among security professionals.