HexBrain

MTN Group · Report #1305766

There is no rate limit for SME REGISTRATION PORTAL

Validstatus
15upvotes
19 Sept 2022disclosed

How it was found

Summary:

The speed limit for the https://mtngbissau.com/registo/ endpoint has not been implemented.

Steps To Reproduce:

  1. Go to the https://mtngbissau.com/registo/
  2. fill out the Registration form
  3. Send request to Intruder.
  4. Set your payloads and start attack.
  5. There is no rate-limit.

Impact

Attacker can register false n-number of request which lead to DDos attack.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original