$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: Flask file storage app with source code provided. Solution: Exploited HTTP Parameter Pollution combined with IDOR - the app uses first user_id for database query but last user_id for access check, allowing access to admin files by passing two user_id parameters.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar