[intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled

How it was found

Hello

Summary:

I have found a no rate limit issue on the report functionality. When you enabled the report functionality on your site, you can set a number of reports before deleting the comment reported. By default, this functionality is unable, but if you enabled this and you set a $x number of reports before deleting the comment, an attacker can spamming this functionality and delete your comment.

Steps To Reproduce:

1. Login at https://intensedebate.com
2. Create your own site at https://intensedebate.com/install, and follow the instructions (use generic install)
3. After setup your site, go to https://www.intensedebate.com/user-dashboard, on click to Moderate.

{F1106120}

4. Go to the comment setting by clicking to Comments

{F1106122}

5. Setup the Report functionality by checked the Enable "Report this comment" button and set a number of reports before deleting the comment to 10 and save it

{F1106130}

6. Go to your site and add a comment
7. With a other account go to your site, and report the comment manually x10
8. After spam the Report functionality
9. Refresh the page, and you will see the comment is deleted

POC

The video POC NoRateLimit.mp4

Thank you,

Fuzzme.

Impact

Delete any comment in any site when the report functionality is enabled