[Access Control] Lab 7: User ID controlled by request parameter with password disclosure

 [Access Control] Lab 7: User ID controlled by request parameter with password disclosure

This lab is apart of my journey on to the burp suite certified practitioner.

again i visit the site first to get a feel for its design and functionality:

Next i click on the My account button to login with the provided username and password.

in the url we can see a possible IDOR vulnerability that can lead to Vertical priv escalation

since we need to delete carlos weʼre looking for some type of admin account and this, is a easily guessable parameter.

I have to change the admin account password so i can login back in after.

i needed to look at the password hidden in the HTML of the site since i was able to change the password of admin.