important E-Mail Input Field bypassed allowing Account Lockout and Takeover in thorsten/phpmyfaq

Valid

Reported on

Jan 24th 2023

Dear Ladies and Gentlemen, First of all, thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Josef Hassan (mohammedzidan99@gmail.com ) and I were able to Account Lockout Vulnerability by bypassing the Input of the E-Mail Address. The Process of identifying the Vulnerability

  1. Login
  2. Go to https://roy.demo.phpmyfaq.de/admin/?action=user&user_id=1
  3. Anybody can change the User E-Mail and it is required to type an E-Mail
  4. If there is no E-Mail the User can maybe lock his account and never get a Passwort Reset E-Mail because no E-Mail Address is written in the Field
  5. We were able to bypass the Security Mechanism and do not need to type an E-Mail Address which can lead to an Account Lockout without any Possibility for Recovery

Thank you very much for your time and effort and hope hearing from you soon.

Best regards Ahmed Hassan & Josef Hassan

Impact

Dear Ladies and Gentlemen, First of all, thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Josef Hassan (mohammedzidan99@gmail.com ) and I were able to Account Lockout Vulnerability by bypassing the Input of the E-Mail Address. The Process of identifying the Vulnerability

  1. Login
  2. Go to https://roy.demo.phpmyfaq.de/admin/?action=user&user_id=1
  3. Anybody can change the User E-Mail and it is required to type an E-Mail
  4. If there is no E-Mail the User can maybe lock his account and never get a Passwort Reset E-Mail because no E-Mail Address is written in the Field
  5. We were able to bypass the Security Mechanism and do not need to type an E-Mail Address which can lead to an Account Lockout without any Possibility for Recovery

Thank you very much for your time and effort and hope hearing from you soon.

Best regards Ahmed Hassan & Josef Hassan

We are processing your report and will contact the thorsten/phpmyfaq team within 24 hours. 2 months ago
A thorsten/phpmyfaq maintainer has acknowledged this report 2 months ago
Thorsten Rinne validated this vulnerability 2 months ago
ahmedvienna has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Thorsten Rinne marked this as fixed in 3.1.11 with commit f34d84 2 months ago
Thorsten Rinne has been awarded the fix bounty
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on Feb 28th 2023
Thorsten Rinne published this vulnerability a month ago
to join this conversation