Allowing long password leads to denial of service in causefx/organizr


Reported on

May 11th 2022


The Organizr application allows to sending a very long password (10000000 characters) it's possible to cause a denial of service attack on the server. This may lead to the website becoming unavailable or unresponsive. Usually, this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the password hashing process will result in CPU and memory exhaustion.

Proof of Concept

1.Sign up to the application, capture the request in burp suites, and send it to Repeater.

2.Copy the payload from this link:- and paste on password parameter and send go.

3.You will see that the application allows long passwords this can leads to Dos and can exploit as DDos

Video PoC


This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.

We are processing your report and will contact the causefx/organizr team within 24 hours. 2 years ago
causefx validated this vulnerability 2 years ago
sampritdas8 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
causefx marked this as fixed in 2.1.2000 with commit e4b4cf 2 years ago
causefx has been awarded the fix bounty
2 years ago


@admin As the fix has been deployed can you assign and publish a CVE for this report?

Jamie Slome
2 years ago

Sorted 👍

to join this conversation