Security vulnerabilities

  • Status Closed
  • Assigned To
  • Private
Attached to Project: Security vulnerabilities
Opened by Fahimhusain Raydurg - 05.02.2024
Last edited by cbay - 06.02.2024

FS#26 - #1 Crititical Vulnerability Name: No Rate Limit in adding Sites which consumes large amount of band

Vulnerability Name: No Rate Limit in adding Sites

- This may consume a large amount of bandwidth and, sometimes, require large amounts of storage space.

How to reproduce this issue:

1. Use Burp Suite and capture the Sites request.

2. Send the captured request to Intruder and select name position as shown in POC.

3. Set payloads to numbers and numbers will be from 1 to 40 (depending on your usage).

4. Observe that the status code is 302 means we can add an unlimited Sites.

1. There should be some rate limit for Add Sites (Example: should not exceed more than 10 Sites)

2. Implement Captcha, the captcha should not be based on IP.

- Video file in below link.
- Link:

Closed by  cbay
06.02.2024 12:53
Reason for closing:  Invalid
cbay commented on 05.02.2024 12:38


There is a rate limit (i.e. a limit to the number of requests you can do in a single minute). The generated bandwidth you've generated is absolutely tiny.

Note that it's unrelated to the number of sites (or, in general, objects) you can have. It is unlimited by choice.

Kind regards,

Hello Cyril,

I would like to inquire about the limitations on the number of items that can be processed in a single minute. If I exceed this limit, will my report still be accepted?

Thank you for your clarification.

cbay commented on 05.02.2024 13:22

No as denial of service attacks are explicitely [excluded]( from our bug bounty scope.


Available keyboard shortcuts


Task Details

Task Editing