Technical impact
The vulnerability allows an attacker to supply crafted inputs to the CAPTCHA generation script, resulting in uncontrolled consumption of memory and CPU resources. Because the parameters (l, a, tf, ql) are accepted without validation, an attacker can repeatedly request CAPTCHA images of arbitrary size or complexity, effectively exhausting server resources and causing the application to become unresponsive.
Affected Systems
e‑SIC Livre (version 0.2.2 and earlier) contains a CAPTCHA generation component located at restrito/inc/captcha.php. No other vendors or product lines have been identified as affected.
Risk and Exploitability
The CVSS score is 7.5, indicating a high severity, and the EPSS score is < 1%, indicating a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. The reported impact is a remote denial of service: an attacker can trigger the victim to send repeated HTTP requests to the CAPTCHA endpoint to consume excessive memory and CPU. Based on the description, it is inferred that the CAPTCHA endpoint is publicly accessible, permitting remote attackers to exercise the exploit without needing authentication. Without a patch or mitigations in place, the vulnerability could be used to degrade availability of the target application.
