PWPP

Practice session

A REST API uses a Node.js/Express framework and automatically binds all JSON body parameters directly to a Mongoose model: `User.create(req.body)`. An attacker sends `{"username": "attacker", "email": "a@b.com", "isAdmin": true}`. The `isAdmin` field is silently set. What vulnerability is this?

Loading your practice session…