CEH Web Application and Injection Attacks Practice Question
A security analyst notices that a web application returns different page sizes when a valid user ID is submitted versus an invalid one in the URL parameter. Which type of vulnerability is most likely being exploited?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure Direct Object Reference (IDOR)
This is a classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability, where an attacker can enumerate valid IDs by observing differences in responses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stored Cross-Site Scripting (XSS)
Why it's wrong here
Stored Cross-Site Scripting (XSS) involves injecting malicious scripts, typically JavaScript, into web applications that are then persistently stored on the server and served to other users. This attack focuses on client-side execution within a victim's browser, aiming to steal cookies, deface websites, or redirect users. The described scenario, however, involves manipulating server-side object identifiers to gain unauthorized access to different data, which is fundamentally distinct from script injection.
- ✓
Insecure Direct Object Reference (IDOR)
Why this is correct
Insecure Direct Object Reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, directory, database record, or key, and fails to implement proper authorization checks. An attacker can manipulate these references, often found in URL parameters or API requests, to access resources belonging to other users or entities without explicit permission. This directly matches the scenario where an analyst changes an ID to view different responses, indicating a bypass of access controls.
- ✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
Cross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user into unknowingly submitting a malicious request to a web application where they are currently logged in. The attacker crafts a request, often embedded in an image or link, and relies on the victim's browser to automatically include session cookies, making the request appear legitimate to the server. This attack focuses on coercing a user's browser to perform an action, rather than an attacker directly manipulating parameters to enumerate or access different objects.
- ✗
SQL Injection
Why it's wrong here
SQL Injection involves an attacker inserting malicious SQL code into input fields, such as login forms or search boxes, to interfere with an application's database queries. This can lead to unauthorized data retrieval, modification, or deletion, or even full database compromise. While different responses can occur, the described behavior of changing a specific ID parameter to access different resources or data points directly to a failure in object-level authorization, rather than an attempt to manipulate the underlying SQL query structure itself.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, a security analyst discovers that a web application uses sequential numeric identifiers in URLs (e.g., /profile?id=100). By modifying the id parameter, the analyst can access another user's profile data without authorization. Which vulnerability is being exploited?
medium- A.SQL injection
- ✓ B.Insecure Direct Object Reference (IDOR)
- C.Server-Side Request Forgery (SSRF)
- D.Cross-Site Request Forgery (CSRF)
Why B: IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references (e.g., database keys) and fails to enforce proper access controls, allowing users to manipulate them to access unauthorized data.
Variation 2. During a web application penetration test, a security analyst intercepts a request using Burp Suite and notices the following parameter in the URL: /profile?user_id=123. By changing the user_id to 124, the analyst is able to view another user's profile. Which vulnerability is being exploited?
medium- A.SQL Injection
- B.Cross-Site Scripting (XSS)
- ✓ C.Insecure Direct Object Reference (IDOR)
- D.Cross-Site Request Forgery (CSRF)
Why C: IDOR occurs when an application exposes a direct reference to an internal object (like a user ID) without proper authorization checks, allowing unauthorized access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.