SourceCoder Online Boat Reservation System 1.0 Broken Access Control Privilege Escalation PoC

Vulnerability Overview Vulnerability Type: Broken Access Control / Privilege Escalation CWE: CWE-862: Missing Authorization CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L Description: The application fails to properly enforce authorization checks on administrative endpoints. Low-privileged regular users can directly access sensitive administrative pages, such as and , without requiring administrator privileges. By manipulating the parameter, attackers can view and modify boat details that should only be managed by administrators. Impact Scope Affected System: SourceCoder Online Boat Reservation System 1.0 Impact: - Low-privileged attackers can access administrative functions. - Low-privileged attackers can modify boat information. - Low-privileged attackers can delete boats. - Low-privileged attackers can add new boats. - Low-privileged attackers can view other users' reservations. - Low-privileged attackers can cancel other users' reservations. - Low-privileged attackers can view other users' personal information. - Low-privileged attackers can modify other users' personal information. - Low-privileged attackers can delete other users' accounts. - Low-privileged attackers can create new administrator accounts. Remediation Recommended Measures: - Ensure that all administrative endpoints perform appropriate authorization checks. - Implement Role-Based Access Control (RBAC) to ensure that only users with appropriate permissions can access administrative functions. - Validate user input to prevent unauthorized access through parameter manipulation. - Regularly review and update the application's security policies to ensure that all potential security vulnerabilities are addressed. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

SourceCoder Online Boat Reservation System 1.0 Broken Access Control Privilege Escalation PoC