Portswigger: User ID controlled by request parameter Writeup

This lab has a horizontal privilege escalation vulnerability on the user account page.

To solve the lab, obtain the API key for the user carlos and submit it as the solution.

You can log in to your own account using the following credentials: wiener:peter

Lab link.

We log in to the system with the login information provided.

/my-account?id=wiener We see that the username is directly mentioned in the URL, we make the request carlos.

Right click on Response>Show response in browser>copy and paste it into the browser and access Carlos’ account.

We added Carlos’ API key to submit solutions and we solved the problem.