Cobalt Vulnerability Wiki
Cobalt Vulnerability Wiki
Categories
V2 - AuthenticationV3 - Session ManagementV4 - Access ControlV5 - Validation/SanitizationV6 - CryptographyV7 - Error LoggingV8 - Data ProtectionV9 - CommunicationsV10 - Malicious CodeV11 - Business Logic DoS - App Crash File Upload - No Size Limit Horizontal Privilege Escalation Negative Bank Transaction No Antivirus - EICAR file Upload Unrestricted File Upload - File Extension Filter Bypass Vertical Privilege Escalation
V12 - Files ResourcesV13 - APIV14 - ConfigV11 - Business Logic
Vertical Privilege Escalation
POC
- Login as UserA
- Using the IDOR vulnerability found, escalate your privileges to Admin user who has higher privileges comparing to UserA
Note: Since this is a business logic vulnerability, the PoC is generalized
Impact
Medium-High
Likelihood
High
Ready to get started?
Join some of these great clients we're proud to have helped