PHPJabbers Meeting Room Booking System Rate Limiting Vulnerability in Forgot Password Feature

A denial-of-service vulnerability has been identified in PHPJabbers Meeting Room Booking System version 1.0, stemming from a lack of rate limiting in the 'Forgot Password' feature. This oversight allows attackers to inundate a legitimate user's email with password reset requests, potentially overwhelming the user's inbox.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition for the affected user, caused by an excessive volume of generated email messages.

Reproduction

To reproduce this vulnerability, log into the PHPJabbers Meeting Room Booking System demo as an admin. Navigate to the 'Forgot Password' feature and use Burp Suite to capture the request. Send the request to the Intruder tab, configure the attack, and start it. The result will be a flood of password reset emails sent to the registered email account.