PHPJabbers Cinema Booking System Rate Limiting Vulnerability in Forgot Password Feature

A denial-of-service vulnerability has been identified in PHPJabbers Cinema Booking System version 1.0, stemming from a lack of rate limiting in the 'Forgot Password' feature. This oversight allows attackers to inundate a legitimate user's email with excessive password reset requests, potentially leading to email account disruption.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by generating a large volume of email messages, which could overwhelm the user's email account.

Reproduction

To reproduce this vulnerability, access the 'Forgot Password' feature on the PHPJabbers Cinema Booking System demo site. Use an email address that is already registered. After capturing the request with a tool like Burp Suite, send it to the Intruder tab, configure the attack, and start it. The result will be a flood of password reset emails sent to the registered email account.