2 IDOR’s & WAF Bypass to Expose Full Event Database
During a recent engagement on a food industry B2B platform, I discovered a vulnerability chain that allowed me to dump the entire database of users registered for a corporate event. By chaining a sequential ID enumeration vulnerability with a secondary IDOR on the “Edit Profile” endpoint - and optimizing the attack by identifying a weakness in the ID generation logic - I was able to access the Personally Identifiable Information (PII) of all event attendees.
Summary
During a recent penetration test on a B2B platform in the food industry, I identified a vulnerability chain that enabled the extraction of the entire database of users registered for a corporate event. By exploiting a sequential ID enumeration vulnerability in conjunction with an Insecure Direct Object Reference (IDOR) on the "Edit Profile" endpoint, and optimizing the attack through analysis of the ID generation logic, I accessed the Personally Identifiable Information (PII) of all event attendees.
The Target
The target was a web application facilitating registration for a trade event by store owners and food companies. The registration form collected sensitive PII, including:
- Full Name
- Email Address
