CVE-2017-9091

High

Published: 19/05/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The /admin/loginc.php file in Allen Disk 1.6 does not check if isset($_SESSION['captcha']['code']) == 1, allowing CAPTCHA bypass by emptying $_POST['captcha'].

Risk Assessment

Bypassing the CAPTCHA mechanism may lead to unauthorized access to the system, posing a serious threat to user data security.

Recommendation

It is recommended to implement proper checks in the code to ensure that the CAPTCHA is correctly validated before processing the login.

Other vulnerabilities in Allen Disk 1.6

CVE-2017-9090High
The reg.php file in Allen Disk 1.6 does not check if isset($_SESSION['captcha']['code'])==1, allowing CAPTCHA to be bypassed via an empty $_POST['captcha'].

Original NVD description (English source)

/admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to CAPTCHA bypass by emptying $_POST['captcha'].

Vulnerability data from NVD (NIST) · CISA KEV · EPSS