CVE-2017-9090

High

Published: 19/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The reg.php file in Allen Disk 1.6 does not check if isset($_SESSION['captcha']['code'])==1, allowing CAPTCHA to be bypassed via an empty $_POST['captcha'].

Risk Assessment

Bypassing the CAPTCHA mechanism may lead to abuses such as automated registrations or brute force attacks on forms. This poses a risk to data integrity and application security.

Recommendation

It is recommended to add proper checks in the code to ensure that the CAPTCHA is correctly verified before processing the form.

Other vulnerabilities in Allen Disk 1.6

CVE-2017-9091High
The /admin/loginc.php file in Allen Disk 1.6 does not check if isset($_SESSION['captcha']['code']) == 1, allowing CAPTCHA bypass by emptying $_POST['captcha'].

Original NVD description (English source)

reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to bypass the CAPTCHA via an empty $_POST['captcha'].

Vulnerability data from NVD (NIST) · CISA KEV · EPSS