Tanuki

Level: Easy Points: 10 Type: Daily Challenge

Lab Interface

In /profile we have optiont to edit our profile

request to update profile

with this request, the first thing that comes in mind is if we can edit the profile of other user so, to test this, i created new account [e-mail]

then I tried to edit the email and password of [e-mail] and got error Email already exists or invalid data

Key thing is username is passed in the request /api/profile/{username}

so, I tried editing the username and it worked

There is no ownership check on /api/profile/{usernname}, meaning anyone with a valid token can edit the details of anyother account.