Webverselabs Salt Brook Pilates Challenge IDOR

Scenario :

Salt Brook Pilates is a founder-led studio in the Hudson Valley running reformer classes out of two storefronts. Drop-ins are $32, monthly unlimited is $260, and the booking site was rewritten last spring by a small contract team. The new profile endpoint went live without a strong-params review — the form only ever submitted four fields, so nobody worried about what else the API would accept.

Soltion :

This was pretty straight forward , i will speedrun it :

/Classes return a list of classes we can take , nothing useful to be fair , /Instructor contains some names , we will note them , we might need them later .

We first start by creating our account :

Looking at the request on Burp :

We see that there are no roles we can modify when we try to create the account .

If we try to make changes to our profile , then check Burp :

PATCH Requests are always interesting , we also see the role field in the response , we can ty to modify our role before sending the request , since this is a PATCH reqest , if there is no Access Control in place we can modify our role to admin :)

If we forward the request :

We notice this Staff endpoint that was added after we got Admin role :

If we visit that endpoint, we should be able to get our Flag .

That was all for this challenge. See you in the next one :)