Changing /api/orders/1001 to /api/orders/1002 shows another customer's order. This vulnerability is…
Options
- XSS: a malicious script injected into the page
- IDOR: broken access control on a direct object ID (Correct option)
- Clickjacking: a hidden frame over the real page
- CSRF: a forged request sent from another site
Answer
IDOR (Insecure Direct Object Reference), a form of broken access control
Why
The server checks that you are logged in, but not that order 1002 belongs to YOU. Anyone can change the number and read others' data.
That is IDOR, a kind of broken access control.
Fix: on every request, check that the logged-in user owns (or may access) that object, e.g. WHERE id = :id AND customer_id = :current_user. Random IDs (UUIDs) make guessing harder but are not a fix on their own.
Remember
Always check the user owns the object they request.