SY0-701 Question 79
Single answer2.3 Explain various types of vulnerabilities.A security analyst is reviewing a web application after users report that they can change the URL from /invoice/1001 to /invoice/1002 and view other customers' invoices without being prompted for additional authorization. The application requires users to log in, but it does not verify whether the authenticated user is allowed to access the specific invoice ID requested. Which of the following best describes this vulnerability?
- A
SQL injection
- B
Cross-site scripting (XSS)
- C
Insecure direct object reference (IDOR)
- D
Race condition
Show answer and explanation
Correct answer: C
Explanation
The best answer is Insecure direct object reference (IDOR). This vulnerability occurs when an application uses user-supplied input to reference internal objects without validating that the user is authorized to access them. In modern guidance, this is commonly discussed under broken access control or broken object-level authorization. Real-world prevention includes enforcing server-side authorization checks for every object request, avoiding predictable identifiers where possible, and using indirect reference maps or access control middleware. This aligns with widely accepted secure development guidance such as the OWASP Top 10, where broken access control is a major category, and the OWASP guidance on IDOR/BOLA patterns.
- A. Incorrect.
Incorrect. SQL injection occurs when untrusted input is included in database queries without proper parameterization, allowing an attacker to alter the query. In this scenario, the issue is not query manipulation but missing authorization checks on directly referenced objects such as invoice numbers.
- B. Incorrect.
Incorrect. Cross-site scripting (XSS) involves injecting malicious script into content viewed by other users, typically due to improper output encoding or input validation. The scenario describes unauthorized access to another user's record by modifying an identifier, not script execution in a browser.
- C. Correct.
Correct. Insecure direct object reference (IDOR) is an access control vulnerability in which an application exposes a reference to an internal object, such as a file name, record number, or invoice ID, and fails to enforce authorization for that object. Here, simply changing the invoice number in the URL allows access to another customer's data, which is a classic IDOR/broken object-level authorization issue.
- D. Incorrect.
Incorrect. A race condition occurs when the outcome of a process depends on timing or the sequence of operations, often allowing unintended behavior when multiple actions happen nearly simultaneously. Nothing in the scenario indicates concurrent execution or timing-based exploitation.