| tiêu đề | light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930 Client-Side Enforcement of Server-Side Security |
|---|
| Mô tả | The registration and login pages display CAPTCHA controls in `App/Home/View/Default/Index/index.tpl:237-242` and `:277-285`, and JavaScript checks them in `Public/Home/js/index.js:71-82` and `:167-178`. However, the AJAX registration and login requests at lines 88-96 and 184-191 do not submit a CAPTCHA value. `App/Home/Controller/UserController.class.php:12-30` and `App/Home/Model/UserModel.class.php:59-110` never validate a CAPTCHA server-side. A script can forge the AJAX header and submit unlimited registration or password-guessing requests without solving a CAPTCHA.
|
|---|
| Nguồn | ⚠️ https://github.com/light0011/cms/issues/13 |
|---|
| Người dùng | gscsd (UID 97914) |
|---|
| Đệ trình | 30/09/2026 17:50 (cách đây 19 ngày) |
|---|
| Kiểm duyệt | 18/10/2026 09:37 (18 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 421673 [light0011 cms Captcha Validation UserController.class.php nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|