Welcome back to another Hacker101 challenge. This one is called Micro-CMS v1.
Start the challenge and open the generated website.
The application lets users create pages using Markdown. Our goal is to find four flags.
Testing Page IDs
Select Create a new page, create a page named cat0x01-test1, and observe the resulting page.
The page URL contains a numeric ID. Sequential IDs can sometimes expose pages that are not linked from the home page, so we can test nearby values for an insecure direct object reference (IDOR).
Most of the tested IDs return 404 Not Found, but page 7 exists.
Stored XSS in Page Content
Return to page 10 and select Edit this page.
To test whether the CMS safely handles HTML in page content, submit the following XSS payload:
<img src="0" onerror=alert("cat0x01_xss")>
The browser executes the injected event handler, confirming stored cross-site scripting. Inspecting the page source reveals the first flag.
Editing Another User’s Page
Next, test whether page 7 can be edited even though it was not created during this session.
Change the page ID in the edit URL from 10 to 7.
The application allows the edit without checking ownership or authorization. This is an IDOR vulnerability, also described more generally as broken access control, and it reveals the second flag.
Triggering an Application Error
On the same page, submit unexpected input to make the application return an error. The result does not by itself prove SQL injection; it shows that the application handles this input unsafely and exposes a challenge flag through its error behavior.
Stored XSS in the Page Title
For the fourth flag, create another page and place an XSS payload in its title while keeping ordinary text in the content field. The created page appears normally at first.
Return to the home page. Because the CMS renders page titles there without proper output encoding, the stored payload executes when the title is displayed in the page list.
The resulting alert reveals the fourth flag and completes the challenge.
