1409
matching the specified identifier [1]. The identifier is selected from a list of all invoices associated
with the current authenticated user.
Example Language: C# (Bad)
...
conn = new SqlConnection(_ConnectionString);
conn.Open();
int16 id = System.Convert.ToInt16(invoiceID.Text);
SqlCommand query = new SqlCommand( "SELECT * FROM invoices WHERE id = @id", conn);
query.Parameters.AddWithValue("@id", id);
SqlDataReader objReader = objCommand.ExecuteReader();
...
The problem is that the developer has not considered all of the possible values of id. Although
the interface generates a list of invoice identifiers that belong to the current user, an attacker can
bypass this interface to request any desired invoice. Because the code in this example does not
check to ensure that the user has permission to access the requested invoice, it will display any
invoice, even if it does not belong to the current user.
Observed Examples
Reference Description
CVE-2021-36539 An educational application does not appropriately restrict file IDs to a particular
user. The attacker can brute-force guess IDs, indicating IDOR.
https://www.cve.org/CVERecord?id=CVE-2021-36539
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 715 OWASP Top Ten 2007 Category A4 - Insecure Direct
Object Reference
629 2331
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 813 OWASP Top Ten 2010 Category A4 - Insecure Direct
Object References
809 2357
MemberOf 932 OWASP Top Ten 2013 Category A4 - Insecure Direct
Object References
928 2390
MemberOf 945 SFP Secondary Cluster: Insecure Resource Access 888 2394
MemberOf 1031 OWASP Top Ten 2017 Category A5 - Broken Access
Control
1026 2437
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Weakness ID : 640
Structure : Simple
Abstraction : Base
Description
The product contains a mechanism for users to recover or change their passwords without knowing
the original password, but the mechanism is weak.
CWE Version 4.14
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-640: Weak Password Recovery Mechanism for Forgotten Password