Description

Ordinary users can use this vulnerability to attack other users' question collection, which can break through a single user's operation of only collecting or canceling the collection, resulting in too many or negative collections

Proof of Concept

step1 . Open burp, click collection, and block the request package

step2 .Right click to send the request package to Turbo Intruder Add a request header x-req: %s , then last code user select examples/race.py and click attack

setp3. Turn off burp interception, refresh your question, and you can see that the limit has been broken

Impact

It can break the limit of user's single collection or cancellation of collection, and attackers can maliciously attack the number of other users' question collections, such as adding/reducing a large number of collections