All Projects

## Summary

When a user tries to create an account at alwaysdata without agreeing to alwaysdata's personal data protection policy, the application displays, “Please click this box if you want to proceed.” Thus, the user must accept alwaysdata's personal data protection policy to create an account. However, this restriction is not properly enforced.

As a result, a user can bypass the restriction and create an account without accepting alwaysdata's personal data protection policy. The exact steps for this bypass are given below.

## Steps To Reproduce

1. Go to: https://www.alwaysdata.com/en/register/?p=2012
2. Try to register an account without agreeing to the personal data protection policy.
3. The application returns: “Please click this box if you want to proceed”. The application enforces the restriction that the user must agree to the personal data protection policy to create an account.
4. Turn on your Burp Suite and configure it properly to intercept all requests.
5. Try to register an account by accepting the personal data protection policy
6. In Burp Suite, intercept the POST request endpoint: /en/register/?p=2012. Observe that the body contains a parameter called “privacy_policy”
7. Change from `privacy_policy=on` to `privacy_policy=off`.
8. Forward the request.
9. The application responds with 302 Found.
10. Verify your email and get access to your account.
11. The account is created successfully without accepting the personal data protection policy.

## Impact

This server-side validation issue allows users to register and access the alwaysdata service without the backend verifying whether the personal data protection policy acceptance requirement has been satisfied or not. As a result, it may create compliance concerns.