0xIncaInsider
HomeBlogArchivesTagsCollectionsAbout
← Writeups
·

User role can be modified in user profile

https://portswigger.net/web-security/access-control/lab-user-role-can-be-modified-in-user-profile

This lab has an admin panel at /admin. It's only accessible to logged-in users with a roleid of 2.

Solve the lab by accessing the admin panel and using it to delete the user carlos.

You can log in to your own account using the following credentials: wiener:peter


Utilizar la funcion de actualizar correo y actualizarlo con el parametro roleid: 2

// 0xIncaInsider — offensive security research