Abusing password reset functionality allows attackers to gain access to web application user accounts. The consequences depend on the functionality of the web application and the permissions of the victim’s account. For example, in a financial application that stores sensitive information, a successful attack could have serious repercussions, such as credit card numbers being exposed. Access to a web application account could also let the attacker attempt privilege escalation, which could lead to further attacks against the web server and more.
Learn about privilege escalation, privilege elevation, and its consequences.