312-50 Question 304
Single answer▪ Web App Hacking MethodologyDuring an authorized assessment of a company's customer portal, you discover that the application uses a numeric parameter in requests such as /invoice/view?id=48217. The portal enforces authentication, but after logging in as a standard user, you can change the id value and retrieve invoices belonging to other users. The application does not validate whether the requested invoice belongs to the authenticated account. According to a proper web application hacking methodology, what is the MOST accurate classification of this issue?
- A
SQL injection, because modifying a numeric parameter exposes backend database records
- B
Insecure Direct Object Reference (IDOR), because object-level authorization is missing for the requested resource
- C
Session fixation, because the application allows a standard user to access another user's session context
- D
Cross-Site Request Forgery (CSRF), because a predictable parameter can be manipulated by an authenticated user
Show answer and explanation
Correct answer: B
Explanation
The best answer is Insecure Direct Object Reference (IDOR). In a practical web app hacking methodology, after authentication testing and parameter analysis, a tester should evaluate whether resource identifiers such as account numbers, document IDs, invoice IDs, or profile references are protected by server-side authorization checks. Simply requiring login is not sufficient; the application must verify that the authenticated user is authorized to access the specific object requested. This weakness is widely aligned with OWASP guidance under Broken Access Control, one of the most critical web application risks. Testers commonly identify this issue by changing predictable identifiers and observing whether access control is enforced on each request. This scenario is not SQL injection because no evidence shows query syntax manipulation, not session fixation because session handling is not being hijacked, and not CSRF because the attack does not rely on inducing another user's browser to send requests.
- A. Incorrect.
Incorrect. Although changing a numeric parameter results in access to other database-backed records, this alone does not indicate SQL injection. SQL injection requires unsafe handling of input in database queries, typically allowing alteration of query structure. In this scenario, the key problem is missing authorization on direct object access, not query manipulation.
- B. Correct.
Correct. This is a classic Insecure Direct Object Reference (IDOR), a type of broken access control where the application exposes a direct reference to an internal object, such as an invoice ID, and fails to enforce authorization checks to confirm the authenticated user is permitted to access that specific object. In modern terminology, this is commonly discussed under broken object-level authorization or broken access control.
- C. Incorrect.
Incorrect. Session fixation involves forcing or reusing a known session identifier so that a victim authenticates into a session the attacker already knows. Here, there is no evidence of session identifier manipulation. The user remains in their own authenticated session and is abusing weak object authorization by tampering with a resource identifier.
- D. Incorrect.
Incorrect. CSRF involves tricking an authenticated victim's browser into sending unintended requests to a target application. The presence of a predictable or modifiable parameter does not make this CSRF. In this case, the tester is directly modifying a request in their own session, which points to an authorization flaw rather than a cross-site request forgery issue.