mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a web application test, a penetration…
During a web application test, a penetration tester discovers that the application exposes internal object references (e.g., user ID in a URL) and does not properly authorize access. The tester can view other users' private data by simply changing the ID parameter. Which type of vulnerability does this represent?
⚠ Common exam trap
CompTIA often tests IDOR by presenting a scenario where a parameter is manipulated to access another user's data, and the trap is confusing it with CSRF (which involves state-changing actions via forged requests) or SQL injection (which involves database query manipulation), rather than recognizing the core issue as missing authorization on direct object references.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object Reference (IDOR)
The vulnerability is Insecure Direct Object Reference (IDOR) because the application exposes internal object references (e.g., user ID in a URL) and fails to enforce proper authorization checks. By simply changing the ID parameter, the tester can access other users' private data without authentication or permission validation, which is the hallmark of IDOR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
CSRF relies on the browser automatically including session cookies with cross-site requests, enabling an attacker to trick an authenticated user into submitting a forged request that performs a state-changing action. It does not involve enumerating or modifying an object reference such as a user ID to directly read another user's resource, and it would not explain accessing random users' data by changing a URL parameter. The scenario described is a server-side authorization failure, not a client-side request forgery.
- ✓
Insecure Direct Object Reference (IDOR)
Why this is correct
Insecure Direct Object Reference occurs when an application exposes a reference to an internal implementation object—most commonly a database key or numeric ID—in a URL or form parameter, and fails to verify the authenticated subject is authorized for that object. By simply changing the user ID in the request, the tester was able to retrieve another user's profile, demonstrating a missing object-level access control check. This is a classic IDOR finding and a type of broken access control.
- ✗
SQL Injection
Why it's wrong here
SQL injection is a code injection technique where an attacker inserts malicious SQL syntax into an input to alter the query structure, such as appending a tautology or UNION SELECT to dump unrelated tables. Simply incrementing or swapping a numeric ID in a URL to view different records uses the application's intended database query and only changes the WHERE clause value, which is not SQLi unless the parameter is concatenated unsafely and the attacker can break out of the query. The presence of other users' data in direct responses points to an authorization flaw rather than an injection flaw.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting involves an attacker injecting executable JavaScript into a web page that is then rendered in another user's browser, typically to steal credentials, session tokens, or perform actions on the victim's behalf. It is a client-side code execution vulnerability, and the object ID change in the URL is executed on the server, returning another user's data to the tester directly. XSS would not cause the server to return foreign profile records just because the ID parameter was changed; the failure here is a missing authorization check.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
IDOR
IDOR (Insecure Direct Object Reference) is a vulnerability where an application exposes internal object references, allowing attackers to access or modify data by manipulating those references.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.