3. Technical Analysis

3.1 Insecure Direct Object Reference (IDOR)

The vulnerability resides in the viewSubmitExamForm endpoint. The server relies on two client-supplied parameters to identify the record to be retrieved:

1. Request Body: {"formid": "XXXXX"}
2. HTTP Header: Router-Path: /view-pcu-exam-form/XXXXX

While the user must be authenticated, the server fails to verify if the authenticated student is authorized to view the data associated with the requested formid. By iterating through numerical IDs, an attacker can access the records of other students.

4. Proof of Concept (PoC)

4.1 IDOR Exploitation

A standard POST request to the vulnerable endpoint with a modified formid yields sensitive student data.

Request:

Response (Summary of Leaked Data):

Uploading Idorpoc.mp4…

5. Impact Assessment

The successful exploitation of this vulnerability allows for:

• Mass Exposure of PII: Access to names, email addresses, student IDs, and login IP addresses of the entire student body.
• Financial Data Breach: Exposure of transaction history, bank IDs, and payment gateway references. This information is highly sensitive and could be used for financial social engineering or fraud.
• Academic Privacy Violation: Unauthorized access to exam forms, mentor assignments, and submission statuses.

6. Remediation Recommendations

6.1 Authorization Fix (Priority: High)

• Implement Server-Side Authorization Checks: The backend must verify that the formid requested belongs to the learnerid associated with the active session. Never trust the formid or Router-Path parameters without validation against the authenticated session token.

6.3 General Hardening

• Minimize Data Output: Ensure the API only returns the fields necessary for the specific UI view. Internal transaction IDs and IP addresses should be redacted unless absolutely required for the user's workflow.
• Session Security: Review the use of custom encrypted headers for session management and consider using standard, hardened JWTs or secure HTTP-only cookies.