Web - Client

maybe a spoiler?

Hey, just a little confused here. I know I need to forge the php session id of the admin in order to get my form to have the correct permissions, but am I supposed to use an xss vulnerability to get that? I tried my solution to the previous challenge (xss stored 1) on this one just to see if it worked but nothing happened. however, I am not sure if I did not wait long enough for the admin bot to recieve my code. am I on the right track at least?

I might be wrong, but it seems like either the challenge is harder than "0 protection" or "admin" never comes to execute JS / trigger resource loading.

Has anyone ideas?

Hello, you don’t need XSS to solve this ^^
But yes you have to do something so that the administrator validate the upgrade ^^

I manage to have the admin running my code... but the account is not activated.. can’t understand why

Well, if it doesn’t work you should check your code again or the way you submit it ;)

Hey can you give me an hint on how to get my code executed by the admin ?

send your javaScript code from Contact and use onload method