嗯，用户让我帮忙总结一篇文章的内容，控制在一百个字以内，而且不需要特定的开头。首先，我得仔细阅读这篇文章，理解它的主要内容。 文章讲的是一个商业逻辑漏洞，作者在xyz网站上发现用户可以通过修改电子邮件格式（比如使用点或字符地址）绕过邮箱唯一性限制。具体流程是先用未被白名单的邮箱注册被阻止，然后用白名单邮箱成功注册。接着，在“未收到邮件”页面，用户可以修改回未被白名单的邮箱并收到确认邮件。 所以，总结的时候需要包括关键点：发现漏洞、利用邮件格式绕过限制、具体流程以及影响。确保语言简洁明了，不超过一百字。 再检查一下是否有遗漏的信息，比如漏洞的影响和建议。作者提到这个漏洞的影响是用户可以在注册页面之外的其他页面绕过限制，并建议在漏洞赏金计划中耐心分析应用的工作原理，检查不同端点之间的验证或规范化是否一致。 最后，整合这些信息到一个简短的总结中，确保涵盖所有重要细节。 </think> 文章描述了一个商业逻辑漏洞：用户通过修改电子邮件格式（如使用点或字符地址）绕过注册时的唯一性限制。初始注册时未被白名单的邮箱被阻止，但用户可在“未收到邮件”页面修改回未被白名单的邮箱并成功接收确认邮件。 2026-1-5 13:14:41 Author: infosecwriteups.com(查看原文) 阅读量:7 收藏
This is a cool business logic flaw. While hunting on the xyz website, I discovered that users could bypass the email-uniqueness restriction during account creation by manipulating email formatting (for example, using dots or character addressing).
Here is the flow:
Page 1: Registration >> Unwhitelisted email (Blocked) >> Whitelisted email (Accepted)
Page 2: Resend token/email not received >> Modify to Unwhitelisted email (Accepted)
The system initially prevent creating accounts with similar email format but then on another tab, users could trigger the “email not received”, then modify the email to the unwhitelisted email format to receive a confirmation email.
Get Umanhonlen Gabriel’s stories in your inbox
Join Medium for free to get updates from this writer.
The impact was how users could bypass the initialy restriction on the account creation page on the not received email page.
Press enter or click to view image in full size
Tips:
Bug bounties require patience and a careful understanding of how an application works. Always check for inconsistent validation or normalization across different endpoints.
Feel Free to connect with me on LinkedIn or X :
https://www.linkedin.com/in/umanhonlen/
Thank you!
如有侵权请联系:admin#unsafe.sh