Login

Scenario

The student dashboard includes a form that updates your role label. The server applies whatever role value you POST without verifying eligibility. Promote yourself to admin and open the admin panel.

Your approach

1. Locate the role update form or endpoint on the dashboard.
2. POST role set to admin while authenticated as a student.
3. Navigate to admin-only pages now visible in the UI.
4. Read secret_flag from admin settings.
5. Submit the admin panel flag.