Which of the following is an example of an IDOR vulnerability?

• A. Cross-Site Scripting (XSS)
• B. SQL Injection
• C. Insecure Direct Object Reference (IDOR)
• D. CSRF

Answer: (C)

Insecure Direct Object Reference happens when an application exposes a direct handle to an internal object and trusts whatever the user supplies to identify that object. The key issue is that the server uses a user-provided reference (like an ID in a URL or a file path) to fetch or affect a resource without verifying that the requester is authorized to access that specific object. Because of that missing check, someone can alter the reference to access someone else’s data or perform actions on resources they shouldn’t be able to touch. For example, if a page retrieves a document based on a number in the URL and doesn’t confirm who owns that document, a user could change the number and gain access to another user’s document.

This concept is distinct from XSS, which involves injecting scripts to run in a victim’s browser; SQL injection, which manipulates database queries; and CSRF, which tricks a user into unknowingly performing unwanted actions. To prevent IDOR, enforce proper authorization on every object reference, use indirect references or mapping, and ensure resources are checked for access rights before disclosure or modification.