Lab: Exploiting server-side parameter pollution in a query string
Summary: PortSwigger's lab walks through exploiting server-side parameter pollution in a password reset query string: sending username=administrator%26x=y returns a "Parameter is not supported" error, showing the internal API treats the injected &x=y as a separate parameter. Truncating with %23 and injecting &field=email%23 reveals a hidden field parameter, and switching it to reset_token returns the administrator's password reset token, which is then used to set a new password, log in as administrator, and delete carlos.
Why it matters: A single user-supplied username field let an attacker pull the administrator's reset token and take over the account, because the server passed input into an internal query string without validating it. Any endpoint that forwards user input to a backend API is a candidate for this same parameter-injection path.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026