IDOR allows me to Download everyone's Marks Card from my university website🔥🔥🔥🔥

I already explained in my previous article → IDOR is everywhere.

IDOR is easy to exploit and doesn’t require much effort to find.

Hello Folks, In this article, I would like to explain the IDOR on my own university application.

Let’s get Started !! 😉

I’m studying for my Post Graduation in 2020 and 2022. During my first semester exams, I received a notification of the result announcement.

I opened my university portal and logged in to check my results.

I clicked on the Exam section of my dashboard 👇

Then I opened the Exam result section👇

Here I need to download my marks card to see my results

After I clicked on the download button, the PDF file gets downloaded into my local machine.

Do you know ?? I’m a hacker 😉 I’m always happy and curious to check the security flaws everywhere.

I again clicked on the download result options, but this time I intercepted the request to see what is happening in the background.

But surprisingly, I saw the following request to download my marks card.

Here the application uses the register number of the student to download or view the marks card.

Immediately, I forward the request to a repeater for a backup and changed the registration number to 053 which is one digit after my registration number and I sent the request.

Boom !!

I’m able to download or read someone's marks card 👇

Success Response of the Victim ID

Marks Card of the victim

Wooww……..

I successfully hacked into my university website.

A similar security flaw I observed during the fees receipt download API as well. I can able to download someone’s receipt/invoice, which contains more information about the students.

Then I will be like;

Me after this finding

That’s it for this write-up.

Happy Hacking 🥂🥂

Thanks for reading.

Please follow me for more writeups.