Elevation of privilege

Client State Manipulation:

When a user interacts with a web application, they do it indirectly through a browser. When the user clicks a button or submits a form, the browser sends a request back to the web server. Because the browser runs on a machine that can be controlled by an attacker, the application must not trust any data sent by the browser.
It might seem that not trusting any user data would make it impossible to write a web application but that's not the case. If the user submits a form that says they wish to purchase an item, it's OK to trust that data. But if the submitted form also includes the price of the item, that's something that cannot be trusted.

                Elevation of privilege

This section of client state manipulation is about changing the state of your user account from standard user to admin. Gruyere points you in the direction of the edit profile page and after a while of searching the page I found that the vulnerability was in the request sent to the server. After hitting the save profile button the page sends a form to the server with a Boolean field for if the current user is an admin, and another field for the username of the admin. After changing those two parts of the request the server will change the current user to an admin giving you rights to change other user’s accounts or delete their posts. This vulnerability stems from the lack of server side validation of client side requests.