webPromedium

Bug Bounty-code

hackerlab

Task: Flask web app with user registration/login where is_admin is hardcoded to false; user input is concatenated into JSON without escaping. Solution: inject closing quote and additional is_admin key into password field, exploiting Python json.loads() duplicate-key-last-wins behavior to escalate to admin.

$ ls tags/ techniques/
flaskauthentication_bypasspythonbase64werkzeugprivilege_escalationparameter_pollutionjson_injectionbbcode
json_string_injection_via_unescaped_inputduplicate_json_key_exploitationprivilege_escalation_to_adminhidden_hint_discovery_base64_in_bbcode
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups