Loading HuntDB...

Captcha bypass at registration

Low
W
Weblate
Submitted None
Reported by proabiral

Vulnerability Details

Technical details and impact analysis

### Affected URL: https://demo.weblate.org/accounts/register/ ### Issue: The captchas are implement so that the site can differentiate between the legitimate user and the bot. The captcha challenge should be something that a bot cannot solve easily and a human could easily solve. However, in the above URL captcha is simple enough that can be read by any script. An attacker can write a simple script to get value of those captcha ( as simple as `document.getElementById("div_id_captcha")` in JS ) and solve them. ### Solution: Image captcha should be implemented whose value cannot be read by script. Google captcha can be an effective solution.

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted