Description

A rate limiting algorithm is used to check if the user session (or IP address) has to be limited based on the information in the session cache. In case a client made too many requests within a given time frame, HTTP servers can respond with status code 429: Too Many Requests. (wikipedia)
I just realize that on the reset password page, the request has no rate limit which then can be used to loop through one request

Proof of Concept

VIDEO POC
https://drive.google.com/file/d/1FhvPexy9NwpFD6kMTvYlXMc7xvwfhnci/view?usp=sharing

Steps To Reproduce:

1. Go to https://demo.froxlor.org/admin_index.php?page=change_password
2. change old and new password
3. Intercept request in burpsuite suite and repeate same request 100 times
4. Once introder attack is completed then try to relogin with new password.

Result:
There are 2 seurity issues observed

1. Application allowed to change same old and new password
2. There is no rate limit on password change functionality