### SMS Functionality Abuse Vulnerability

Multiple types of abuse exist.

#### SMS Bombing Vulnerability

##### Common Characteristics

- **Key Defect**: The SMS sending function has **no rate limiting** set, or the restrictions are insufficient (e.g., missing CAPTCHA, human verification, etc.), enabling automated bulk sending of SMS messages.
- **Aggravating Characteristics**: The SMS bombing vulnerability can exist even without the following characteristics, but the impact is worsened when they are present:
    - Allows direct or indirect control of SMS recipients
    - Allows control of some or all of the SMS content; even if the content is not controllable, fixed-content messages can flood the target and consume SMS service quota

##### No-Risk Special Case

The SMS sending logic is entirely controlled internally and cannot be triggered externally (directly or indirectly), such as automatically sending alert SMS messages.

#### SMS Content Forgery

##### Common Characteristics

- **Key Defect**: When constructing SMS content or reset links, review the risk of directly concatenating frontend-passed parameters (such as URLs, Host, custom text) into the SMS template without whitelist validation (leading to phishing content injection).
> The key issue is that users can control the SMS content. Even if special characters are filtered, it cannot prevent exploitation for phishing attacks. The best practice is to not allow users to control SMS content.
