Level 04 - Unsigned Campus Ticket

Category: Web logic, Authorization | Difficulty: Medium

A toy ticket format is parsed without proper signature validation.

What participants receive: /api/level04, /api/level04/token or /api/level04?action=token, /api/level04/submit or /api/level04?action=submit

Objective: Escalate a training ticket to maintainer privilege and obtain the flag.

curl https://ctf-trpl-wbi.vercel.app/api/level04
curl "https://ctf-trpl-wbi.vercel.app/api/level04?action=token"
curl -X POST "https://ctf-trpl-wbi.vercel.app/api/level04?action=submit" \
  -H "content-type: application/json" \
  -d '{"token":"<edited-token>"}'