User Role Can Be Modified in User Profile

Lab#

User role can be modified in user profile · Apprentice

Solution#

Given#

This lab has an admin panel at /admin. It's only accessible to logged-in users with a roleid of 2.

Solve the lab by accessing the admin panel and using it to delete the user carlos.

You can log in to your own account using the following credentials: wiener:peter

Analyzing the task#

Looks like a specific hint here — the admin panel is accessible to users with roleid=2, and the role can apparently be changed in the user profile. We need to reach the admin panel and delete the user carlos.

Recon#

Let's check the user profile — there's a change-email form. OK, let's change it. The request goes out:

POST /my-account/change-email
{"email":"xxx@xxx.ru"}

The response:

{
  "username": "wiener",
  "email": "xxx@xxx.ru",
  "apikey": "sNK5lPO4Q9iCMxU18Tevh5HTKt9NmR9Y",
  "roleid": 1
}

Interesting — so we might pass the role along with the email and change it? We send the request into Repeater, add the roleid field with value 2. Send — voilà, the role changed.

Reload the page, the admin panel is available. Delete the user. Lab solved!