IDOR Vulnerability: Authorization Bypass via ID Parameter in Order Management

Vulnerability Overview IDOR / Authorization Bypass — every cancel, delete, and approve action accepts without verifying ownership #13 This vulnerability involves the use of user-supplied as a SQL primary key to manipulate records under the and paths. There is no comparison against , nor any ownership check. Consequently, any user, including anonymous callers, can influence any order, table, menu item, or registered user. The laboratory example demonstrates that calling as an anonymous request deleted Bob’s order, even though the order belonged to a different . Impact Scope Affected Version: Commit: 7f0e7e4255e8fcfa48b62f9f1451b6ef18dc Vulnerability Type: Authorization Bypass via User-Controlled SQL Primary Key (CWE-639) / IDOR Affected Code: - - - - - - Remediation Root Cause: The application assumes “if the URL is valid, you have permission to execute.” The destructive endpoints lie outside of any access control checks; the only session verification occurs in (as seen in , , etc.). While reading rows uses , the action endpoints accept an arbitrary and use it directly. Steps: 1. Seed orders with different users. 2. Delete Bob’s order as an anonymous caller. 3. Delete Bob’s table reservation in the same manner. 4. Approve or reject any order via the admin interface (still acting anonymously). POC Code Impact The application lacks the concept of “your orders” versus “their orders.” Any caller can enumerate orders by guessing IDs (e.g., , , etc.) and either delete them or flip their status. Combined with CVE-04 (SQL injection on the same parameter), this provides a large-scale DELETE/UPDATE primitive. Combined with CVE-18 (CSRF), it can be triggered from any authenticated admin’s browser. CVSS 3.1 Score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 8.1 (High) (These same files on the unauthenticated sub-flow were previously reported individually as CVE-13 Critical; this entry covers the ownership check aspect of the sub-flow.)

Goal Reached Thanks to every supporter — we hit 100%!

IDOR Vulnerability: Authorization Bypass via ID Parameter in Order Management

More from this source