Lab 197 — BillForge — Authorization Bypass via HTTP Parameter Pollution

hackadvisor

Task: Express.js invoicing platform with role-based access control on invoice API endpoint using query parameter id. Solution: HTTP Parameter Pollution — sending duplicate id params (?id=own&id=admin) bypasses authorization (checks first value) while database returns admin's confidential invoice (uses last value).