How I Escalated Privileges from ‘User’ to ‘Admin’
This article covers a privilege escalation vulnerability, allowing an unauthorized user to access administrative functions. The flaw was due to the application using weak permissions for file uploads (e.g., copying user-uploaded files into the ‘admin’ directory). By modifying an image file's name to include the ‘index.php’ extension (image_name.jpg.index.php), the researcher overwrote the existing index.php file within the 'admin' folder upon upload. This resulted in their uploaded content being served as the admin dashboard. The attacker then leveraged a JavaScript payload injected into their malicious image file to execute arbitrary PHP code, allowing them to access and manipulate the entire application. A realistic consequence would be an unauthorized user gaining control over sensitive data, functionality, or settings. The researcher received $500 as payout from the bug bounty program, with the company fixing the issue by validating uploaded file names and restricting permissions for sensitive directories. Key lesson: Strictly enforce access controls and validate all user-supplied input to prevent privilege escalation vulnerabilities. #BugBounty #PrivilegeEscalation #FileUploads #WebSecurity #Cybersecurity
https://infosecwriteups.com/how-i-escalated-privileges-from-user-to-admin-0e6aa72274fc?source=rss------bug_bounty-5