HexBrain

Weblate · Report #479021

No Rate Limit On Add new word

Validstatus
lowseverity
5upvotes
14 Jan 2019disclosed

How it was found

Hello I found in that there is no limit in the place of adding a new word which allows the attacker to add an infinite number of words which may cause a problem in the site and the server

Steps To Reproduce :

1. Go To https://hosted.weblate.org/dictionaries/andors-trail/en/#add And Fill in fields
2.Click On Add
3.And interceptThe Request With Proxy ( Burp )
4.And Send The Request To Inturder
5.And Go to Payloads and Select In The Payload type > Numbers ...
6.Click On Start Attack

POC :

{F405705} {F405706}

Impact

An attacker could cause a problem for the server

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original