Love Letter Locker
An insecure direct object reference exposes another user’s private letter—and the flag—by changing its numeric ID.
access-control
1 post
1 post
An insecure direct object reference exposes another user’s private letter—and the flag—by changing its numeric ID.