Logical Vulnerability #117
Description
Hazard: Allowing the creation of multiple accounts with the same phone number can facilitate fraudulent activities against merchants, such as scams and "exploiting loopholes for small gains" (e.g., repeatedly claiming promotional benefits), among other risks.
Exploitation Method:
During the registration process, perform a packet capture and modify the request. By adding %20 (a URL-encoded space) before the phone number, the system's validation can be bypassed. This allows a single phone number to register an unlimited number of accounts with different passwords.
