No Rate Limit protection in user subscription form
Low
S
Sifchain
Submitted None
Actions:
Reported by
aliyugombe
Vulnerability Details
Technical details and impact analysis
## Summary:
Hello
I found your form that user can subscribe for any update has no rate limit protection.
##Step to reproduce
1. Visit http://sifchain.finance and move to subscribe form and enter email
2. click on `sign-up` button.
3. use burpsuite to intercept the request and send to intruder.
4. Clear payload
5. Select null payload and enter 10 in generate payload field.
6. Click on start attack.
7. You will see all the request have 200 response code (Means ok and send)
8. Check your email you will see 10 emails form sifchain asking you to confirm your subscription
## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
* [attachment / reference]
## Impact
Attacker can use this vulnerability to do email bombing attack to any victim's email.
While if you are using third-party service to send this mail, you will be charge for sending those mails
Report Details
Additional information and metadata
State
Closed
Substate
Duplicate