Lab 192 — StockFlow — Broken Authentication via CSRF Token Reuse

hackadvisor

Task: Express.js inventory management platform with staff/admin roles; admin settings contain the flag but staff users get 'Access Denied'. Solution: Discovered legacy admin user creation endpoint in commented-out JavaScript, reused a CSRF token from the profile page to create a new admin account (endpoint lacked authorization check), then logged in as admin to retrieve the flag from /admin/settings.