312-50 Question 348
Single answer▪ Web App SecurityDuring an authorized web application assessment, you test a customer portal that uses a URL such as https://portal.example.com/account?user_id=1042 to display account details. After authenticating as a standard user, you change the parameter to user_id=1043 and successfully view another customer's profile data without receiving an authorization error. The application uses HTTPS and requires login for access. Which vulnerability best describes this issue?
- A
SQL injection, because modifying a numeric parameter can expose backend database records
- B
Insecure Direct Object Reference (IDOR), because the application exposes a direct reference to an internal object without enforcing proper authorization
- C
Cross-Site Request Forgery (CSRF), because the application accepts a request that changes user context through a crafted URL
- D
Session hijacking, because the tester was able to access another user's data after authenticating
Show answer and explanation
Correct answer: B
Explanation
The best answer is Insecure Direct Object Reference (IDOR). In modern terminology, this falls under broken access control, one of the most critical web application risks identified by OWASP. The defining characteristic is that the application uses user-supplied identifiers such as account numbers, file names, or record IDs to locate resources, but does not enforce server-side authorization checks for each object request. HTTPS and login do not prevent this issue; transport security protects data in transit, and authentication confirms identity, but neither replaces authorization. A secure design should validate on the server that the authenticated user is permitted to access object 1043 before returning any data. This aligns with OWASP guidance on Broken Access Control and IDOR prevention, including indirect object references where appropriate and mandatory per-object access checks on every request.
- A. Incorrect.
Incorrect. SQL injection involves injecting malicious SQL syntax into application inputs to alter queries or extract data from the database. In this scenario, the tester simply changes a predictable object identifier and the server returns another user's data. That indicates missing object-level authorization, not evidence of SQL syntax manipulation or query injection.
- B. Correct.
Correct. This is a classic Insecure Direct Object Reference (IDOR), now commonly discussed under broken access control. The application exposes a direct reference to a resource identifier (user_id) and fails to verify that the authenticated user is authorized to access the requested object. The key issue is not authentication, since the tester is logged in, but insufficient authorization enforcement on the referenced resource.
- C. Incorrect.
Incorrect. CSRF occurs when a victim's authenticated browser is tricked into sending an unwanted request to an application where the victim is already logged in. Here, the tester is manually modifying their own request and observing missing access controls. There is no evidence of cross-site request submission or exploitation of a victim's browser session.
- D. Incorrect.
Incorrect. Session hijacking involves stealing or reusing another user's valid session token or cookie to impersonate them. In this case, the tester remains in their own authenticated session and gains access by changing a parameter. The problem is authorization failure on object access, not compromise of session management.