CVE-2018-14596
Description
wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) URI in which the values of font_size, width, and height are large numbers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"The application does not properly validate large numeric inputs for image dimensions, leading to resource exhaustion."
Attack vector
An unauthenticated remote attacker can send requests to the `checkcode` API endpoint with excessively large values for `font_size`, `width`, and `height` parameters. This causes the server to consume significant resources while attempting to generate the verification code image. The delay in response can be observed by monitoring the server's return time, and repeated requests can lead to the application becoming unresponsive or crashing [ref_id=1].
Affected code
The vulnerability exists in the `checkcode` API endpoint, specifically within the logic that handles the `font_size`, `width`, and `height` parameters. The provided reference points to the `index.php?g=api&m=checkcode&a=index` URL as the vulnerable path [ref_id=1].
What the fix does
The advisory suggests that the server-side should validate the parameters related to the verification code generation, specifically `font_size`, `width`, and `height`. Alternatively, these parameters could be removed from the link or a different verification code mode could be employed. The patch does not show specific code changes, but the recommendation implies that input sanitization or limiting the range of these parameters would mitigate the vulnerability.
Preconditions
- networkThe target system must be accessible over the network.
- inputThe attacker needs to be able to send HTTP requests to the `checkcode` API endpoint.
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- github.com/HUILYUH/wancms/blob/master/README.mdmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.