A7 : Missing Function Level Access Control

A7 : Missing Function Level Access Control

OpenDNS Leadership

There is a function on this page that lacks Access Control.

Look at the source code to find out the hidden function.

Hint 1

Look at the div with id 'admin_view'
Solution

Remove the style 'display:none' in the div with id 'admin_view' to make the hidden div visible. As this function lacks server side access control, you would be able to exploit this functionality.