webProeasy
Lab 110 — FlowDesk — Mass Assignment Privilege Escalation
hackadvisor
Task: team collaboration platform with REST API exposing role field in user profile response. Solution: exploit mass assignment by adding role=admin to profile update request, bypassing frontend restrictions to gain admin access.
$ ls tags/ techniques/
role_escalationapi_parameter_tamperingmass_assignment_exploitationhidden_field_injection
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 351 — FlowForge — RCE via Python Code Validation Endpoint— hackadvisor
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 330 — AuthVault — Blind LDAP Injection in Directory Lookup— hackadvisor
- [web][Pro]Lab 198 — PayrollSync — Broken Auth via GraphQL Introspection— hackadvisor
- [web][Pro]Lab 106 — ApproveBot — AI Privilege Escalation via Context Injection— hackadvisor