PHPJabbers Hotel Booking System Rate Limiting Vulnerability in Email Settings

A denial-of-service vulnerability has been identified in PHPJabbers Hotel Booking System version 4.0, stemming from a lack of rate limiting in the 'Email Settings' feature. This vulnerability allows attackers to send a large volume of emails on behalf of a legitimate user, potentially overwhelming the user's inbox.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing a significant increase in email traffic for the affected user.

Reproduction

To reproduce this vulnerability, log into the dashboard and navigate to the 'Email Settings' section under 'System Options'. Enter any email address and name in the respective fields. Capture the request data using Burp Suite and send it to the Intruder tab. Configure the Intruder options and launch the attack. The emails will be received in the inbox of the account used.