On this page
apsyleg1 min read
#portswigger #access-control #web-security

User ID Controlled by Request Parameter

Lab

User ID controlled by request parameter · Apprentice

Solution

Given

This lab has a horizontal privilege escalation vulnerability on the user account page.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

Analyzing the task

Looks like a very simple lab. We need to get the API key of user carlos. To do that we just have to change the user id passed to the route.

Recon

Log in as our user, look at the requests:

GET /my-account?id=wiener

The API key is here. Change the parameter to ?id=carlos:

GET /my-account?id=carlos

<div id=account-content>
    <p>Your username is: carlos</p>
    <div>Your API Key is: mxH4cyoguaAAuo3kCtqzv1ySjfORtagJ</div>

Lab solved.

More in this category

Arbitrary Object Injection in PHP (PortSwigger Lab)

Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.

Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)

Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.

Modifying Serialized Data Types (PortSwigger Lab)

Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.