Second order IDOR lab

Product 1 is read-only. Editing it directly in the grid is blocked in the browser and rejected by the server (update.php).

But edits can also be queued as drafts and applied later by a separate privileged step (publish.php). Can you make a draft that the publish step will apply to a product you were never allowed to touch?

CSV queues one draft per row. Format: id,"name",pricedownload example.

Click a cell in the grid to edit editable products in place.

Product Grid

ID Name Price
1 Product 1 10.99
2 Product 2 19.99
3 Product 3 5.99

Pending drafts

No pending drafts.