In this post of Month of Bugs in Captchas we continue our talk about one of previous participants of the project - Cryptographp. It is captcha plugin for WordPress. Vulnerable version is Cryptographp 1.2 (and previous versions).
This captcha in addition to Insufficient Anti-automation is also vulnerable for XSS (like Math Comment Spam Protection). These Cross-Site Scripting holes I found 22.11.2007.
There are 24 XSS holes and they are persistent XSS. Holes are at plugin options page (http://site/wp-admin/options-general.php? page=cryptographp/admin.php) in parameters cryptwidth, cryptheight, bgimg, charR, charG, charB, charclear, tfont, charel, charelc, charelv, charnbmin, charnbmax, charspace, charsizemin, charsizemax, charanglemax, noisepxmin, noisepxmax, noiselinemin, noiselinemax, nbcirclemin, nbcirclemax, brushsize. For attacking you need to make POST request to plugin options script.
These exploits for educational purposes only. Don’t use these holes and exploits for malicious purposes.
You need to setup exploits to test them (set site’s URL and others data).
Moral: always make more secure captchas and without XSS holes.