Lab 109 — TaskForge — IDOR in Account Settings API

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: idor_exploitation, parameter_tampering

Summary

Task: an account settings page exposed a client-controlled userId used by the API. Solution: tamper with the userId parameter to request the admin account and extract the flag from its api_key.

Lab 109 — TaskForge — IDOR in Account Settings API — hackadvisor

Description

Credentials were provided for user@test.com/password123. The settings page contained <div id=currentUserId data-user-id=9>, and /js/settings.js fetched /api/account/settings?userId=9.

English summary: the goal was to inspect the account settings flow and determine whether the API enforced authorization server-side.

Analysis

The page exposed the current user ID in the DOM and reused it directly in a settings API request. Because GET /api/account/settings?userId=<id> trusted the client-supplied userId, the endpoint allowed horizontal and vertical account data access by changing the numeric ID. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

An HTML comment contained a decoy prompt-injection flag, but it was not part of the vulnerable data path and was ignored.

Solution

1. Log in as user@test.com with password password123.
2. Open the settings page and inspect /js/settings.js.
3. Observe the request to /api/account/settings?userId=9.
4. Change the parameter to userId=1.
5. The response returns the admin account, whose api_key contains the real flag.

 http read-only • copy allowed Copy
GET /api/account/settings?userId=1 HTTP/1.1

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍