Enviar #864383: SourceCodester Online Examination & Learning Management System 1.0 NO

Title: Insecure Direct Object Reference (IDOR) in view.php

An Insecure Direct Object Reference (IDOR) vulnerability exists in view.php of the CICT Portal (Online Examination & Learning Management System). The application accepts an "id" parameter in the URL (http://localhost/cictportal/view.php?id=7) to display content but fails to verify that the authenticated user has permission to access the requested resource.

By manipulating the "id" parameter, any authenticated user can access content belonging to other users, including instructor-only materials, exam keys, and restricted lesson content.

**Affected File:** view.php
**Parameter:** id
**Example URL:** http://localhost/cictportal/view.php?id=7

**Proof of Concept:**
1. Login as a standard student account.
2. Navigate to: http://localhost/cictportal/view.php?id=8
3. Change the "id" value to 2, 3, 5, 7, or any numeric value.
4. Observe that restricted content is displayed without permission errors or redirects.

**Impact:**
- Unauthorized access to instructor-only materials
- Exposure of sensitive exam content and answer keys
- Bypass of enrollment-based access controls
- Privacy violation (accessing other users' content)

**Root Cause:**
The application uses a direct object reference (the "id" parameter) to retrieve content from the database without implementing server-side authorization checks. The system authenticates the user but fails to authorize access to the specific object.

**Remediation:**
- Implement server-side permission checks before displaying content
- Verify user enrollment in the associated course
- Use indirect references (UUIDs/tokens) instead of sequential IDs
- Apply role-based access control (RBAC) to all object access
- Implement the "deny by default" principle

**CWE:** CWE-639 - Insecure Direct Object Reference
**OWASP:** A01:2025 - Broken Access Control

• Usuario: Adnan (UID 96526)
• Sumisión: 2026-06-20 09:12 (hace 2 meses)
• Moderación: 2026-08-06 10:39 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 386533 [SourceCodester Online Examination & Learning Management System 1.0 /view.php ID escalada de privilegios]
• Puntos: 17