Business Logic flaw on login page

I am Prathamesh Pawar, I am writing this article for knowledge purpose so that everyone can check for this kind of flaw also. I have found this flaw on very well known web application but I can’t disclose the name of program for security reason. so let’s assume it as Prawar.com

I am checking the signup page of Prawar.com, I have enter all the details and created the account. I have used Password= “Abc@1234” while creating the account.

As per my checklist the next step is to check whether we can re-signup or not on the application. So I try to create account with same email address and different password. This time I used Password=”Abc@12345".

Account was successfully created with same email address. So I reported this bug to the program on 14th October 2020 at afternoon, but they response me with message that you are using the same looking password and closed my report as stating NOT APPLICABLE

So then I check whether we can do same kind of things on login page or not.

I check this time on login page with following password and it’s still working

• Abc@1234, Abc@12345

Then I thought lets try different things with password, then I try passwords:

• Abc@123, Abc@123456

But it’s not working at this time. Then I again try to enter initial looking passwords by changing last character, means if have signup with password=”Abc@1234" then while login, we can do changes at Abc@1234$

here in place of “$” we can put any alphanumeric value between A-Z, a-z and 0–9. so the mechanism at server side is checking only for password is Present or not in given string. no matter after the password what character we insert, it still accepting the password and we can do this multiple times.

15–10–2020 …………Reported

19–10–2020 …………Not applicable

Thank you for reading

Happy and safe hacking