Loading HuntDB...

No Rate Limit protection in user subscription form

Low
S
Sifchain
Submitted None
Reported by aliyugombe

Vulnerability Details

Technical details and impact analysis

## Summary: Hello I found your form that user can subscribe for any update has no rate limit protection. ##Step to reproduce 1. Visit http://sifchain.finance and move to subscribe form and enter email 2. click on `sign-up` button. 3. use burpsuite to intercept the request and send to intruder. 4. Clear payload 5. Select null payload and enter 10 in generate payload field. 6. Click on start attack. 7. You will see all the request have 200 response code (Means ok and send) 8. Check your email you will see 10 emails form sifchain asking you to confirm your subscription ## Supporting Material/References: [list any additional material (e.g. screenshots, logs, etc.)] * [attachment / reference] ## Impact Attacker can use this vulnerability to do email bombing attack to any victim's email. While if you are using third-party service to send this mail, you will be charge for sending those mails

Report Details

Additional information and metadata

State

Closed

Substate

Duplicate

Submitted