Lab 1: Basic User Profile Access

// Vulnerable: No authorization check
$user_id = $_GET['user_id'] ?? $_SESSION['user_id'];

// Simulate user database
$users = [
    1 => ['id' => 1, 'username' => 'user1', ...],
    2 => ['id' => 2, 'username' => 'user2', ...],
    3 => ['id' => 3, 'username' => 'admin', ...]
];

// Direct access without checking if user is authorized
if (isset($users[$user_id])) {
    $profile_data = $users[$user_id];
    // Display profile data
}

// Example vulnerable usage:
// ?user_id=1 (own profile - allowed)
// ?user_id=2 (other user's profile - unauthorized access)
// ?user_id=3 (admin profile - unauthorized access)