# User ID controlled by request parameter with password disclosure #### [Horizontal to vertical privilege escalation](https://portswigger.net/web-security/learning-paths/server-side-vulnerabilities-apprentice/access-control-apprentice/access-control/horizontal-to-vertical-privilege-escalation) ## Description This lab has user account page that contains the current user's existing password, prefilled in a masked input. To solve the lab, retrieve the administrator's password, then use it to delete the user `carlos`. You can log in to your own account using the following credentials: `wiener:peter` ## Solution

we can start login as wiener user

Checking this request we can see that this page has as the username 'wiener' as id parameter

and in the response there's a cleartext password!

So, trying to change the id with 'admnistrator' we're able to disclosure administrator's password:

Now we can login as administrator, access to Admin panel and delte 'Carlos' user completing the lab!