Security vulnerabilities

  • Status Closed
  • Assigned To
    cbay
  • Private
Attached to Project: Security vulnerabilities
Opened by monty099 - 31.07.2024
Last edited by cbay - 31.07.2024

FS#66 - *Title:* Insufficient Validation Allows Multiple Accounts Creation Under Single Subscription Plan

*Title:* Insufficient Validation Allows Multiple Accounts Creation Under Single Subscription Plan

*Description:*
A vulnerability has been identified in the subscription management system which allows users to create multiple accounts under the same subscription plan. This issue can be exploited to bypass restrictions on the number of accounts per plan and gain unauthorized benefits.

*Steps to Reproduce:*

1. *Create an Account:*

  1. Sign up for a new account with a specific subscription plan (e.g., "Free Plan").

2. *Create a Duplicate Account:*

  1. Attempt to create another account using the same subscription plan as the first account.
  2. Notice that the system does not prevent the creation of multiple accounts under the same subscription plan.

3. *Create a Similar Plan Account:*

  1. From the newly created account, sign up for a subscription plan similar to the first account's plan.

4. *Send an Invitation:*

  1. Send an invitation from the second account to the first account to become an admin of the plan created by the second account.

5. *Accept the Invitation:*

  1. After accepting the invitation, the first account will now have two accounts under the same subscription plan.

I sent a proof of concept: https://admin.alwaysdata.com/support/77431/375639-poc.mp4

*Impact:*

This vulnerability allows users to circumvent subscription limitations by creating multiple accounts under the same plan

Closed by  cbay
31.07.2024 07:15
Reason for closing:  Duplicate
Additional comments about closing:  

https://security.alwaysda ta.com/task/51

Loading...

Available keyboard shortcuts

Tasklist

Task Details

Task Editing