search

zihuaweng / software-security-banking

Banking web with vulnerabilities
0 stars 0 forks source link

Able to create an account with a balance higher than 4294967295.99 #1

Closed rafbel closed 4 years ago

rafbel commented 4 years ago

This is an input validation vulnerability, where there is an error in one of the validation procedures for the balance field.

In order to exploit this vulnerability, I first created an account with a negative balance and got the following error message back: image

Then I created an account with an initial value higher than the maximum allowed amount, and was able to create a user with that balance as shown below:

image

When I log in, this is my account page: image

jgarci40 commented 4 years ago

It's not so clear to me how this is advantageous for an attacker.

zihuaweng commented 4 years ago

Thank you @rafbel for pointing it out. Actually it is a bug that I forgot the check the boundary of the initial account. I think I will get a deduction in the build phase for correctness, but basically it is not the injected vulnerability.

rafbel commented 4 years ago

I agree, gonna close the issue.