Valid CAP Dumps shared by EduDump.com for Helping Passing CAP Exam! EduDump.com now offer the newest CAP exam dumps, the EduDump.com CAP exam questions have been updated and answers have been corrected get the newest EduDump.com CAP dumps with Test Engine here:
After purchasing an item on an e-commerce website, a user can view their order details by visiting the URL: https://example.com/?order_id=53870 A security researcher pointed out that by manipulating the order_id value in the URL, a user can view arbitrary orders and sensitive information associated with that order_id. This attack is known as:
Correct Answer: A
The scenario describes a vulnerability where a user can manipulate the order_id parameter in theURL (e.g., https://example.com/?order_id=53870) to access other users' order details, indicating a lack of proper access control. This is a classic case of anInsecure Direct Object Reference (IDOR)attack. IDOR occurs when an application exposes a reference to an internal object (e.g., an order ID) that can be manipulated by an unauthorized user to access resources they should not have access to, without validating the user's permissions. * Option A ("Insecure Direct Object Reference"): Correct, as the ability to change order_id to view arbitrary orders fits the definition of IDOR. * Option B ("Session Poisoning"): Incorrect, as session poisoning involves corrupting or altering a user' s session data, which is not indicated here. * Option C ("Session Riding OR Cross-Site Request Forgery"): Incorrect, as CSRF involves tricking a user into submitting a request (e.g., via a malicious form), not manipulating a URL parameter directly. * Option D ("Server-Side Request Forgery"): Incorrect, as SSRF involves tricking the server into making unauthorized requests to internal or external resources, which is not the case here. The correct answer is A, aligning with the CAP syllabus under "Insecure Direct Object References (IDOR)" and "OWASP Top 10 (A04:2021 - Insecure Design)."References: SecOps Group CAP Documents - "IDOR Vulnerabilities," "Access Control," and "OWASP Testing Guide" sections.
