Description

The attacker has the ability to send any number of requests to the endpoint due to the absence of rate-limiting.

Steps to reproduce

• Simply capture the adding coupon request and send it to burp.
• Send it to the repeater tab and you will be able to send many requests without blocking.

Impact

The attacker will maybe get a valid coupon code that gives him a discount that he doesn't deserve.

Fix

implement any rate-limiting method like captcha or block user requests after some failed trials.