Web applications have become essential tools for communication, commerce, and information dissemination in an era where the internet is pivotal in our daily lives. However, as the digital landscape continues to evolve, so do the threats that target web applications. Web application security ensures the integrity, availability, and confidentiality of online services. Hash collisions, though often considered a theoretical concern, can threaten web application security under specific circumstances. A hash collision occurs when two different inputs produce the same hash value when hashed. This paper utilizes a white-box penetration testing approach specifically targeting hash collision vulnerabilities in web applications. Using PHP as our example language, we create an experimental website to demonstrate privilege escalation by exploiting hash collision vulnerabilities.