Inconsistent security controls

Platform: PortSwigger | Category: Business logic vulnerabilities | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Business logic vulnerabilities

Summary

Walkthrough of the PortSwigger Web Security Academy lab Inconsistent security controls (Business logic vulnerabilities). This lab demonstrates a business logic vulnerabilities vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Business logic vulnerabilities

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Descriprtion :

Overview :

Applications may appear to be secure because they implement seemingly robust measures to enforce the business rules. Unfortunately, some applications make the mistake of assuming that, having passed these strict controls initially, the user and their data can be trusted indefinitely. This can result in relatively lax enforcement of the same controls from that point on.

If business rules and security measures are not applied consistently throughout the application, this can lead to potentially dangerous loopholes that may be exploited by an attacker.

Solution :

The admin panel is at /admin.

It is only available to users logged in with @dontwannacry.com.

Create a test account using the provided email & verify the registration by clicking on the link sent to our inbox.

Once loggedin , we are presented with this page, where we can update our email-id.

Thinking from an attacker's perspective, we can understand that the the site checks whether we are an employee of that company or not by either checking the email-id or some form of cookie or special parameters like ?isdontwanacry=true.

On analysing the requests which is been sent, we don't see any suspicious paramters . So it is definitly checking the email-d.

Since we have an option to update our email, why not change it from attacker@exploit-0a4c008d03485779833ef97d01750004.exploit-server.net to attacker@dontwannacry.com?

Now we are able to view the /admin page.

Delete the user carlos to solve the lab.

Key Takeaways / Lessons

• Understanding Business logic vulnerabilities detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Inconsistent security controls