Loading HuntDB...

No Rate On Add Suggest

Low
W
Weblate
Submitted None
Reported by elmahdi

Vulnerability Details

Technical details and impact analysis

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
###Hello ###Description : ####I have found that there is no limit in the number of requests in place of adding suggest, which may exploit the vulnerability of the attacker to send a large number of suggestions, for example, send a million suggest may lead to cause a problem to the server ###Steps To Reproduce : ####1. Go To https://hosted.weblate.org/translate/andors-trail/game-content/ar/?checksum=c4ddb61773f5e641#suggestions add And Fill in fields ####2.Click On Add ####3.And intercept The Request With Proxy ( Burp ) ####4.And Send The Request To Inturder ####5.And Go to Payloads and Select In The Payload type > Numbers ... ####6.Click On Start Attack ###POC : {F408287} {F408288} ###Remediation : ####1. limit the functionality to x attempts in a predefined period before blocking the account ####2. set up a captcha to prevent robots ## Impact ####An attacker could cause a problem for the server

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')