Track A · Stage 6

1. Log in (creds on the page). Your invoice is /invoice?id=2. Change it to /invoice?id=1. Why: the server fetches the invoice by id alone and never checks that it belongs to the logged-in user, so any id is reachable.

2. Invoice id=1 belongs to the admin and contains the flag.

Lesson: enforce object-level authorization — verify the resource owner matches the session on every request.

1. Log in as the normal user. The profile update request sends a hidden role=user field (or a role cookie). Change it to role=admin (edit the form field or cookie in DevTools / with curl). Why: the server reads your role from the request instead of from the server-side session, so you can promote yourself.

2. Now /admin is accessible and prints the flag.

Lesson: derive privileges from trusted server-side session state, and enforce function-level checks on every sensitive endpoint.