Lab: User ID controlled by request parameter
Summary: PortSwigger's Web Security Academy lab presents a user account page whose URL carries the username in an "id" parameter, creating a horizontal privilege escalation vulnerability. The solution is to log in as wiener, send the request to Burp Repeater, change the "id" parameter to carlos, and retrieve carlos's API key.
What's compelling: The only thing separating one user's account page from another's is a value the client controls, so anyone who can edit a request parameter can reach another user's API key.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026