Lab: Modifying serialized objects
Summary: PortSwigger's Web Security Academy lab uses a serialization-based session mechanism that is vulnerable to privilege escalation through a PHP serialized object stored in the session cookie. The cookie is URL and Base64-encoded, and its admin attribute holds b:0 for false; changing it to b:1 in Burp Repeater re-encodes the object and grants access to the /admin page, from which the user carlos can be deleted.
Why it matters: The entire privilege boundary here is a single boolean in a client-side cookie, so anyone who can decode Base64 can flip b:0 to b:1 and reach the admin panel without any credential.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026