Sifchain · Report #1195429
No Rate Limit protection in user subscription form
Duplicatestatus
lowseverity
5upvotes
14 May 2021disclosed
How it was found
Summary:
Hello I found your form that user can subscribe for any update has no rate limit protection.
Step to reproduce
- Visit http://sifchain.finance and move to subscribe form and enter email
- click on
sign-upbutton. - use burpsuite to intercept the request and send to intruder.
- Clear payload
- Select null payload and enter 10 in generate payload field.
- Click on start attack.
- You will see all the request have 200 response code (Means ok and send)
- Check your email you will see 10 emails form sifchain asking you to confirm your subscription
Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
- [attachment / reference]
Impact
Attacker can use this vulnerability to do email bombing attack to any victim's email. While if you are using third-party service to send this mail, you will be charge for sending those mails