View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0007996 | OXID eShop (all versions) | 1.05. Users | public | 2026-08-20 07:35 | 2026-08-20 07:35 |
| Reporter | suabo | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 6.5.4 | ||||
| Summary | 0007996: No rate limit on forget password leads to email triggering | ||||
| Description | Rate limiting is a strategy for limiting network traffic. It puts a cap on how often someone can repeat an action within a certain timeframe – for instance, trying to log in to an account. and I found victim mailbox flooding due to no rate limit on forgotten password areas The issue is that there is a speed bump missing in the forgot password area. This would eventually let the attacker spam to *any *random email resulting in exhaustion of resources on your side . | ||||
| Steps To Reproduce | 1 - open this link : /passwort-vergessen/ 2 - Enter the email of the victim 3 - Intercept the request in burp suite 4 - Send the request to the intruder and clear payload positions 5 - Use null payloads and set the payload count to 100 or 10000 times as much as you like to. 6 - Click on start attack 7 - The victim will receive the emails in the inbox | ||||
| Additional Information | Impact If the company is using any email service software API or some tool that has been bought for the emails being sent on the support domain, the rate limit can result in financial loss and it can also slow down your services as huge/mass mails will lead to disruption of data that original user might send or the quota that has been bought might be exhausted. Mitigation 1 - IP Based Blocking 2 - Captcha 3 - Firewall 4 - Reducing the number of API requests | ||||
| Tags | No tags attached. | ||||
| Theme | Not defined | ||||
| Browser | Not defined | ||||
| PHP Version | Not defined | ||||
| Database Version | Not defined | ||||
