Lab: Inconsistent security controls
Summary: PortSwigger's lab describes a web application whose flawed logic lets arbitrary users reach administrative functionality intended only for company employees. The lab instructs users to register with an arbitrary email address in a specified format, then access the admin panel and delete the user carlos.
What's compelling: The control here is a registration message telling DontWannaCry employees to use their company email address, not a check that enforces it, so anyone who registers in the expected format inherits employee-level access.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026