Mass Assignment
BeginnerThis profile update API accepts the raw request body and applies it directly to the database. Exploit mass assignment to escalate your privileges, then learn how to fix it with allowlists.
Progress:
1
Escalate Privileges2
Apply the FixPUT/api/users/42
Database Record — users[42]
id42
nameJohn Doe
emailjohn@example.com
roleuser
verifiedfalse
Server Code
// No filtering — vulnerable
db.update(userId, req.body);
db.update(userId, req.body);