Captcha bypass at registration
Low
W
Weblate
Submitted None
Actions:
Reported by
proabiral
Vulnerability Details
Technical details and impact analysis
### Affected URL:
https://demo.weblate.org/accounts/register/
### Issue:
The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above URL captcha is simple enough that can be read by any script.
An attacker can write a simple script to get value of those captcha ( as simple as `document.getElementById("div_id_captcha")` in JS ) and solve them.
### Solution:
Image captcha should be implemented whose value cannot be read by script.
Google captcha can be an effective solution.
Report Details
Additional information and metadata
State
Closed
Substate
Informative