VYPR
Unrated severityNVD Advisory· Published Jul 25, 2018· Updated Aug 5, 2024

CVE-2018-14596

CVE-2018-14596

Description

wancms 1.0 through 5.0 allows remote attackers to cause a denial of service (resource consumption) via a checkcode (aka verification code) URI in which the values of font_size, width, and height are large numbers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1

Patches

Vulnerability mechanics

Root cause

"The application does not properly validate large numeric inputs for image dimensions, leading to resource exhaustion."

Attack vector

An unauthenticated remote attacker can send requests to the `checkcode` API endpoint with excessively large values for `font_size`, `width`, and `height` parameters. This causes the server to consume significant resources while attempting to generate the verification code image. The delay in response can be observed by monitoring the server's return time, and repeated requests can lead to the application becoming unresponsive or crashing [ref_id=1].

Affected code

The vulnerability exists in the `checkcode` API endpoint, specifically within the logic that handles the `font_size`, `width`, and `height` parameters. The provided reference points to the `index.php?g=api&m=checkcode&a=index` URL as the vulnerable path [ref_id=1].

What the fix does

The advisory suggests that the server-side should validate the parameters related to the verification code generation, specifically `font_size`, `width`, and `height`. Alternatively, these parameters could be removed from the link or a different verification code mode could be employed. The patch does not show specific code changes, but the recommendation implies that input sanitization or limiting the range of these parameters would mitigate the vulnerability.

Preconditions

  • networkThe target system must be accessible over the network.
  • inputThe attacker needs to be able to send HTTP requests to the `checkcode` API endpoint.

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.