xmyronn/cve-2026-6201-idorProof-of-concept demonstrating an IDOR vulnerability in CodeAstro Online Job Portal allowing authenticated employers to delete arbitrary job postings via manipulated id parameter.
The Online Job Portal Project in PHP MySQL developed by CodeAstro
fails to verify whether the authenticated user owns the job posting
before processing a delete request. By changing the id parameter
in the GET request, an attacker can delete job postings belonging
to other employers.
id parameter to Employer A's job IDstep 1:- GET /online-job-portal-php-mysql/jobs/job-delete.php?id=[victim_job_id] HTTP/1.1 Host: target Cookie: [attacker_session_cookie]
from user A we will make a new job post and we will take note of the id here which is 41
step 2 :-
from the user B we will delete its job post but intercept it using burp
as we can see the user B job post id is 39
step 3 :-
we can change the job post id from 39 to 41 and delete user A job post with user B account
in this picture we can see that the job post id has been changed from 39 to 41
and then we can see that it has been successfully deleted
step 4 :-
if we go to the user A account and look for the postedJobs endpoint we can see that the job post has been deleted
HTTP/1.1 302 Found Location: /online-job-portal-php-mysql/users/postedjobs.php?msg=deleted
Any authenticated employer can permanently delete job postings belonging to other employers on the platform, causing data loss and disruption of service.