Description

As per the functionality we only can add user role as a “USER” in account Due to the no server side valaditon on “role” parameter , we can add new member as a “HOST” role with all HOST users privilege

Proof of Concept

1. while adding new user intercept the request in burp
2. change the POST body role paramater value as “HOST”
3. the newaly added user have HOST users privilege

refer ss/Video POC : https://drive.google.com/drive/folders/1CqD7SKaBMx3ms7Px3vKFR-9puI_a0V-a?usp=sharing