The script has a feature to log failed login attempts and block ips after X attempts. However, when the ip manage to log in all logs about the previous failed attempts from this ip are removed.
Here is how this can be exploited: If the script is configured to block an ip after 10 failed attempts a bot can try 9 passwords on one account and then log in another account, resetting the logs. This process can be repeated forever.
To solve it, the script should not remove the logs after a successful login. Those logs should remain in the table for at least 24h.
