Access Control: Privilege Escalation

Access control mechanisms relying on insufficiently validated user input could allow an attacker to gain unauthorized access to sensitive application resources and functionality.

Privilege escalation issues occur when an attacker can bypass access control checks by submitting carefully crafted request parameter values. Applications that fail to sufficiently validate user supplied values that influence access control decisions expose themselves to authorization bypass threats. This can lead to attackers gaining access to sensitive resources or ability to remotely execute malicious arbitrary commands.
Example: The following code demonstrates authentication of administrative accounts

$admintest = 0;
if(isset($admin)) {
  if(!IsSet($mainfile)) { include("mainfile.php3"); }
  $admin = base64_decode($admin);
  $admin = explode(":", $admin);
  $aid = "$admin[0]";
  $pwd = "$admin[1]"; 

  dbconnect();
  $result=mysql_query("select pwd from authors where aid='$aid'");
  if(!$result) {
    echo "Selection from database failed!";
    exit;
  } else {
    list($pass)=mysql_fetch_row($result); 

    if($pass == $pwd) {
      $admintest = 1;
    }
  }
} 

The example code above uses the $admin value for access control checks. Any variables, either from cookies or forms (GET/POST) will be automatically made global to the script by PHP. An attacker can therefore manipulate the value of the admin variable by passing the desired value using a request parameter. If $pwd (an element of that "scrambled" $admin) does not match the value that corresponds to the fetched row, the false authentication ($admintest = 0) is returned, otherwise we'll be able to access any function in admin.php3.
To bypass the authorization checks, the attacker needs to ensure that $pass == $pwd. The $pass value returned from mysql_fetch_row() could be anything, or could be FALSE if there are no more rows. The attacker in this case can exploit the mismatch in the datatype to equalize $pwd (string-type) and $pass (logical-type). The expression "if($pass == $pwd)" only compares values, NOT the type. As a result, setting $pwd = "" (null) will be EQUAL (though not identical) to the given FALSE value of $pass.
To force the value of $pass to FALSE, the attacker only needs to set $aid to a string value that does not exist in the authors database. This will result in the mysql_query() call to return TRUE and the mysql_fetch_row() call to return FALSE.
Thus the attacker can fully bypass the authorization checks using the following values:

$aid = "blabla"; $pwd = "";

and send the result of base64_encode("$aid:$pwd") in the admin request parameter.