Expensey Eats — DalCTF 2026
An alg:none JWT forgery grants admin, UNION-based SQLi reveals a hidden $99,999 vault dish, and a broken-authorization order flow lets the admin buy it for free — the flag arrives in a one-time Flask flash message.
Broken-Authorization
No writeups match your filter.