Objective
Access the confidential invoice of another user (Admin) by manipulating the URL parameters.
Background
Insecure Direct Object Reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input without proper authorization checks.
You are logged in as a standard user, 'johndoe', and you are viewing your own invoice.
The Code (Simulated)
The backend logic looks like this:
invoice_id = request.GET['id']
// VULNERABILITY: No check if user owns this invoice!
invoice = db.query("SELECT * FROM invoices WHERE id = ?", invoice_id)
return render(invoice)
How to Exploit
Observe the URL in the simulated browser. It likely contains an identifier for the document you are currently viewing.
Try modifying that identifier to access documents belonging to other users. You might need to guess the ID of the administrator's invoice.
Hint: If your invoice ID is 1002, maybe the administrator's invoice was generated slightly earlier? Try 1001 or 1000.