Lab: User ID controlled by request parameter with password disclosure
Summary: PortSwigger's Web Security Academy lab presents a user account page that displays the current user's existing password prefilled in a masked input, and the exercise is solved by changing the "id" parameter in the URL to administrator to retrieve the administrator's password. Using the supplied credentials wiener:peter, the solver logs in, views the response in Burp to find the administrator's password, then logs in as administrator and deletes the user carlos.
What you should know: The account page hands back the stored password itself rather than a token or hash, so anyone who can edit a single URL parameter can read the administrator's credentials and act as that account.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026