> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-9.md).
# lab-9
## User ID Controlled by Request Parameter with Password Disclosure
**Difficulty:** Apprentice
### Lab Description
This lab's user account page prefills the current user's password in a masked input field. Combined with a horizontal access control vulnerability, this allows an attacker to retrieve any user's password — including the administrator's.
**Objective:** Retrieve the administrator's password, then use it to log in and delete the user `carlos`.
**Credentials:** `wiener:peter`
### Solution
**Step 1 — Identify the vulnerable endpoint**
Log in as `wiener:peter` and capture the requests in Burp. Navigate to the account page and observe the URL:
```
GET /my-account?id=wiener
```
Send this request to Repeater.
**Step 2 — Confirm the session is not validated**
Remove the session cookie and send the request. The server returns `wiener`'s full account page — including the password prefilled in a masked `` field in the raw HTML. The back-end does not validate whether the session matches the requested `id`.
**Step 3 — Access carlos's account (horizontal escalation)**
Change the parameter to `id=carlos`:
```
GET /my-account?id=carlos
```
A `200` response returns Carlos's account page. The raw HTML contains his password in the masked password field. This demonstrates **horizontal privilege escalation** — a regular user reading another regular user's data.
**Step 4 — Access the administrator's account (vertical escalation)**
Change the parameter to `id=administrator`:
```
GET /my-account?id=administrator
```
The response returns the administrator's account page. Search the response body for `type="password"` — the administrator's password is present in plaintext in the HTML source.
**Step 5 — Log in as administrator and delete carlos**
Use the recovered password to log in as `administrator`. Navigate to the **Admin panel** and delete the user `carlos` to complete the lab.
### Conclusion
This lab demonstrates both types of privilege escalation chained together:
* **Horizontal escalation** — accessing another user's account at the same privilege level (e.g. reading carlos's data as wiener).
* **Vertical escalation** — using the same flaw to access a higher-privileged account (administrator) and then abusing those elevated privileges.
Prefilling passwords in page source is itself a bad practice, but the root cause here is the missing server-side check binding the session to the requested account ID.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-9.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.