Vulnerability Overview
The application stored user credentials in plain-text cookies and controlled admin authorization through a client-side admin=false cookie. Both can be read and modified by any user, allowing credential theft and privilege escalation with no brute force required.
Exploitation
After registering and logging in, the Cookie Editor extension revealed three cookies:
| Cookie | Value |
|---|---|
name | admin |
password | 123 |
admin | false |
Logging in with admin / 123, then changing the admin cookie to true and refreshing the page returned the flag immediately.
Root Cause
Authorization state stored client-side is not authorization — it is a suggestion. Any attacker can change admin=false to admin=true in seconds. The server must independently verify authorization on every request using a session stored server-side.
Key Insight: A cookie value of
admin=false is not a security control — it is a parameter the user can edit. Authorization decisions must be made server-side by querying a database or session store, never by trusting a client-supplied value.