From Path Guessing To Dashboard Takeover: Broken Access Control Leads to Full Country-Level Data Manipulation!
Good evening everyone,
This is my first write-up – I hope it’s short, smooth, and brings some real value 🙏🏼
The vulnerability was found on a government domain, part of a Bugcrowd private program.
For privacy reasons, I’ve changed some of the scenario details.
Let’s dive in:
While reviewing one of their systems, I noticed something interesting…
Each country had its own login page, something like:
/login_newzealand_indicators.php
From the name, it seemed like a country-specific dashboard for viewing or editing indicators related to New Zealand.
The pattern stood out clearly – so I thought:
What if I replace “login” with “update”?
Just to see if anything happens…
I tried:
/update_newzealand_indicators.php
And boom 💥
The dashboard opened without any authentication at all!
No login required.
No session.
No token.
Just full access to:
• Edit country indicators
• Upload files
• Save changes
At this point, a thought hit me:
If New Zealand is exposed, what about the rest?
So I manually collected the full list of country names from the homepage and created a custom wordlist.
Then I began fuzzing:
/update_japan_indicators.php.
/update_turkey_indicators.php.
/update_sweden_indicators.php.
…
Result?
More than 10 different country dashboards were accessible the same way – no authentication, full access.
But that’s not all.
While reviewing the JavaScript files (as I usually do for hidden or client-side references), I found something even worse:
One of the .js files explicitly referenced the update endpoint – written in plain sight.
So not only is the endpoint unauthenticated…
It’s also exposed client-side!
No token
No session
No CSRF
No cookie
Just a direct endpoint that allows anyone to modify sensitive data
Vulnerability Classification (VRT):
[Broken Access Control] – Unauthenticated Data Modification
It was triaged, confirmed, and rewarded by the program 🙏🏻
Final Thoughts:
Sometimes, you don’t need advanced techniques or fancy tools.
Just a clear observation, simple pattern recognition, and a bit of curiosity can open serious doors.
Thanks for reading!
