Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by sharmaraghs - 22.07.2024
Last edited by cbay - 22.07.2024

Summary:
The removal of account is one of the sensitive part of a web application that needs to protect, therefore removing an account should validate the authenticity of the user, however i have found that when removing an account, the system did not require the user to input the account password.
Steps To Reproduce:
1.Create an account on https://alwaysdata.com
2.Go to My account section DELETE ACCOUNT.
3.Click on delete and you will see it will delete the account without any kind of verification or password confirmation.

Impact
Exploit Scenario: The user logins to a shared computer (office, library, cafe) Left the account open. Intruder came and try to delete the users account Intruder can easily delete the account because the system did not protect it by asking the password to validate that the person deleting the account is the real user.

Regards
Raghav Sharma

POC Link -: https://drive.google.com/file/d/1iu1gb0l44_sTqG2Ol-ZTbLc0ZKHYkO-f/view?usp=drive_link