Nasty Bug in SecurityImages 5.1.2

Tweet

Share

Thanks to Margus Pala, a security Flaw has been reported and corrected in SecurityImages version 5.1.2 and previous

The flaw is of moderate level, in register forms, spammers are able to register without solving the Captcha!

• It affect only SecurityImages 5.x for Joomla! 1.5
• SecurityImages 6.x for Joomla! 1.6 is not affected

In order to resolve this issue, you don’t have to install any new version of SecurityImages, you must either

• Update your blog with the right version of the joomla! patches, the all end with Joomla_1.5.x-Stable-Full_PackageForSecurityImages5.y.z_v01.03.00

OR

• Edit the file components\com_user\controller.php and remove the line 274 ($this->register())

if ($useSecurityImagesInRegister && !$this->checkSecurityImagesCaptcha()) {
  JError::raiseWarning('', JText::_('SECURITYIMAGES REJECT USER ENTRY'));  
  $this->register();
  return false;
}

These patches versions have the flaw

04/12/2008  Joomla_1.5.1-Stable-Full_PackageForSecurityImages5.0.0.zip
05/01/2008  Joomla_1.5.2-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
05/01/2008  Joomla_1.5.3-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
07/10/2008  Joomla_1.5.4-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
08/03/2008  Joomla_1.5.5-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
08/03/2008  Joomla_1.5.6-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
08/19/2008  Joomla_1.5.6-Stable-Full_PackageForSecurityImages5.1.0_v01.00.00.zip
09/13/2008  Joomla_1.5.7-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
09/20/2008  Joomla_1.5.7-Stable-Full_PackageForSecurityImages5.1.0_v01.00.00.zip
11/11/2008  Joomla_1.5.8-Stable-Full_PackageForSecurityImages5.0.0_v01.00.00.zip
01/19/2009  Joomla_1.5.8-Stable-Full_PackageForSecurityImages5.1.0_v01.01.00.zip
01/19/2009  Joomla_1.5.9-Stable-Full_PackageForSecurityImages5.1.0_v01.01.00.zip
03/28/2009  Joomla_1.5.10-Stable-Full_PackageForSecurityImages5.1.0_v01.01.00.zip
06/03/2009  Joomla_1.5.11-Stable-Full_PackageForSecurityImages5.1.0_v01.01.00.zip
07/04/2009  Joomla_1.5.12-Stable-Full_PackageForSecurityImages5.1.x_v01.01.00.zip
07/26/2009  Joomla_1.5.13-Stable-Full_PackageForSecurityImages5.1.x_v01.01.00.zip
07/26/2009  Joomla_1.5.14-Stable-Full_PackageForSecurityImages5.1.x_v01.01.00.zip
09/11/2009  Joomla_1.5.14-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
11/09/2009  Joomla_1.5.15-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
04/24/2010  Joomla_1.5.16-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
04/24/2010  Joomla_1.5.17-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
09/12/2010  Joomla_1.5.18-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
04/24/2010  Joomla_1.5.20-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
01/09/2011  Joomla_1.5.21-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
01/09/2011  Joomla_1.5.22-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip
01/09/2011  Joomla_1.5.23-Stable-Full_PackageForSecurityImages5.1.x_v01.02.00.zip

You can download the updated versions in HERE or search the download section, type 1.5.23 for the patches for 1.5.23 for example

You might also like:

1020 days ago

HOW to make your own patches for securityimages

Just in case I take too much time to deliver a ready to use download, duration 5 minutes, but you ne

1030 days ago

Joomla_1.5.13-Stable-Full_PackageForSecurityImages5.1.x_v01.

Only for SecurityImages 5.1.x and Joomla! 1.5.13 Allow login views, login modules, register, lost

1052 days ago

Joomla_1.5.12-Stable-Full_PackageForSecurityImages5.1.x_v01.

Only for SecurityImages 5.1.x and Joomla! 1.5.12 Allow login views, login modules, register, lost

1052 days ago

SecurityImages 5.1.2 available

This version should improve installations on some host, where the plugin securityimages.php did no

1083 days ago

Joomla_1.5.11-Stable-Full_PackageForSecurityImages5.1.1.zip

The Joomla! community is pleased to announce the immediate availability of Joomla! 1.5.11 Since

1150 days ago

Joomla_1.5.10-Stable-Full_PackageForSecurityImages5.1.1.zip

The Joomla! community is pleased to announce the immediate availability of Joomla! 1.5.10 Since

1196 days ago

SecurityImages 5.2.0 in active development

Following the Preview of SecurityImages 5.2.0, I am currently developing a proof of concept using th

1218 days ago

New patches for Joomla 1.5.9 and Joomla 1.5.8

Some people have reported issue in the forum I've found the error in my code in some views but not

CedThumbnails