Lab 27 — AdReach — CSRF + IDOR Account Takeover via Profile Update

hackadvisor

Task: advertising campaign management platform with profile update API that uses client-supplied u_id without authorization checks, plus password reset endpoint that leaks tokens in response. Solution: exploit IDOR in /api/profile/update to change admin's email, then abuse password reset token disclosure to take over admin account and access private workspace containing the flag.