IDOR - Delete Users Saved Projects
Program: U.S. Dept of Defense
Bug Type: IDOR
Bounty: Unspecified
Date: 2020-02-20
IDOR
Summary
The researcher found a vulnerability where a user can delete the saved searches of other user. The vulnerability was present in the search_id parameter where it takes an ID (unique for each user). if an ID of other user was passed, it would delete the saved searches of other user. since the IDs were incremental and guessable, an attacker could potentially bruteforce the id to delete saved seaches for every user.