validator/OmCTF-2025/sploits/block-game/README.md

Sploit 1

Flagstore 1. Unbeatable levels (their prizes)

Vulnerability: No bounds check in the MoveOutOfWay function (checked on the client side). The levels are beatable by going out of bounds.

Fix: Add bounds check in the MoveOutOfWay function:

if p.X < 0 || p.Y < 0 || p.X >= sess.Tiles.size || p.Y >= sess.Tiles.size {
    return false
}

Sploit 2

Flagstore 2. Private levels (their prizes)

Vulnerability: Backdoor in the Level.CreateFrom function (hidden in the template with a bunch of tabs which get it out of the screen). It creates a user with name and password both equal to sha256(level_name)[:32], which can then be used to access the level and the flag.

Fix: remove the backdoor code from create_from.tmpl and regenerate OR remove it directly from create_from.go.