This lab has a horizontal privilege escalation vulnerability on the user account page.
To solve the lab, obtain the API key for the user
carlosand submit it as the solution.You can log in to your own account using the following credentials:
Lab link.wiener:peter
We log in to the system with the login information provided.
/my-account?id=wiener We see that the username is directly mentioned in the URL, we make the request carlos.
Right click on Response>Show response in browser>copy and paste it into the browser and access Carlos’ account.
We added Carlos’ API key to submit solutions and we solved the problem.
