Description

The website receives input from the user that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Proof of Concept

Step 1: We have a user with ID 18833 and the username is user1, which cannot be changed. Step 2: Choose Edit user and click Save button, intercept the HTTP request. We add User[users_name]=user1-changed to the body data of the HTTP request and then send it. Step 3: As we can see the username of user 18833 has been changed to user1-changed

Note that: we can change the username of the Superadmin demo by adding User[uid]=1' (id of user demo is 1)

Impact

Able to change the username field that is by default unchangeable