Write-Ups

Overview Platform: BugForge Vulnerability: SQL Injection (UNION-based) — share_code path parameter concatenated directly into SQL query Key Technique: UNION SELECT to extract usernames and p...

Overview Platform: BugForge Vulnerability: JWT None-Algorithm Bypass leading to admin privilege escalation Key Technique: Forging an unsigned JWT with alg:"none" and type:"admin" to bypass s...

Overview Platform: BugForge Vulnerability: Client-Side Price Tampering — Server Trusts Client-Sent Prices Key Technique: Modifying the amount, unit_price, and total_price values in payment a...

Overview Platform: BugForge Vulnerability: Business Logic Flaw — Hidden Purchase Type Bypasses Payment Key Technique: Fuzzing the checkout type parameter to discover an undocumented “till” v...

Overview Platform: BugForge Vulnerability: Insecure Direct Object Reference (IDOR) on User Statistics Endpoint Key Technique: Path parameter manipulation on /api/stats/:userId to access othe...

Overview Platform: BugForge Vulnerability: SQL Injection (Authentication Bypass), Client-Side Price Manipulation Key Technique: Classic SQLi on login username field — string concatenation in...

Overview Platform: BugForge Vulnerability: Broken Access Control — Cross-Organization User Hijacking, Broken Object-Level Authorization on Permission Updates Key Technique: Adding an existin...

Overview Platform: BugForge Vulnerability: Insecure Direct Object Reference (IDOR) Key Technique: Password change endpoint uses id from request body instead of JWT — any authenticated user c...

Overview Platform: BugForge Vulnerability: Race Condition (TOCTOU) on currency conversion endpoint Key Technique: HTTP/2 single-packet attack exploiting non-atomic balance check/deduction wi...

Overview Platform: BugForge Vulnerability: Stored Cross-Site Scripting (XSS) via Direct Messages Key Technique: Injecting HTML into unsanitized DM content field rendered via dangerouslySetIn...

Overview Platform: BugForge Vulnerability: IDOR via Predictable Share Token Key Technique: Reverse-engineering base64-encoded share tokens to access arbitrary gift lists without authenticati...

Overview Platform: BugForge Vulnerability: Insecure Direct Object Reference (IDOR) — password change endpoint trusts client-supplied user_id Key Technique: Replacing user_id in the password ...

Overview Platform: BugForge Vulnerability: XXE via XInclude — Arbitrary File Read Key Technique: XInclude directive bypass of DTD restrictions in XML parser to exfiltrate server files Resu...

Overview Platform: BugForge Vulnerability: IDOR (Insecure Direct Object Reference), Client-Side Price Manipulation, Wildcard CORS Key Technique: Sequential ID enumeration on order detail end...

Vulnerability: Race Condition (TOCTOU), SQL Injection (INSERT-only) Key Technique: Cart/checkout time-of-check-time-of-use race — adding expensive items to cart during checkout processing wind...

Overview Platform: BugForge Vulnerability: Insecure Direct Object Reference (IDOR) via Socket.io WebSocket event Key Technique: Enumerating message IDs through an unauthenticated Socket.io p...

Overview Platform: BugForge Vulnerability: OTP Bypass via JSON Array Parameter Injection, Broken Access Control via Gateway Entitlement Override Key Technique: Sending all 10,000 OTP codes i...

Overview Platform: BugForge Vulnerability: Broken Access Control on admin endpoints; Rounding exploit in stock trading Key Technique: Accessing admin-only API routes with a regular user JWT ...

Overview Platform: BugForge Vulnerability: Insecure Direct Object Reference (IDOR) — missing authorization check on snippet deletion Key Technique: Exploiting inconsistent authorization betw...

Overview Platform: BugForge Vulnerability: XML External Entity (XXE) Injection Key Technique: XXE via XML deck import endpoint with in-band exfiltration through stored entity values Result...

Overview Platform: BugForge Vulnerability: Payment calculation bug (tip formula error), inconsistent input validation between endpoints Key Technique: Exploiting a flawed tip calculation for...

Overview Platform: BugForge Vulnerability: Mass Assignment Key Technique: Injecting unvalidated fields into profile update JSON body to overwrite server-side loyalty points balance Result:...

Vulnerability: GraphQL Introspection Disclosure, IDOR via GraphQL Query, Plaintext Password Storage Key Technique: GraphQL introspection to discover schema, then direct object reference via us...

Overview Platform: BugForge Vulnerability: Stored XSS, WAF Bypass Key Technique: oncontentvisibilityautostatechange event handler bypasses keyword-based WAF blocklist, fires via content-visi...

SQL injection with function filter bypass on a cargo booking application. Bypassed WAF restrictions on SQL functions to extract database contents.

Mass assignment to enable MFA on admin account, then brute-force the 4-digit OTP to bypass MFA and access the admin panel.

Unicode case mapping bypass to access the admin panel. Exploiting server-side Unicode normalization to circumvent role validation.

SQL injection combined with information disclosure on MesaNet access panel. Error-based extraction to gain access to the dev console.

Second-order SQL injection via stored username payload. Injected during registration, triggered when the application queries user data.

Server-side template injection in Jinja2 via EXIF metadata, escalating from SSTI confirmation to full RCE and root shell.

Prototype pollution to bypass access controls and reach a 403-protected admin endpoint via __proto__ payload injection.