IDOR at 'media_code' when addings media to questions

How it was found

Summary:

Hi team, When you add a question to your survey and click Save, it sends this request : {F893416}

In this request, media_code is vulnerable for IDOR. If you change it to any media ID, you will see it on your question. And these IDs are sequential. So you can access to any user's media contents.

Steps To Reproduce:

1. Create a survey
2. Add any question like Free Text and open your proxy program
3. Click to question and click Save
4. Your proxy program will catch the request
5. Change the media_code parameter's value to a 7 digit number. Like 2013124 (my media content)
6. Send the request, you will see the victim's media.

Impact

Access to user's media contents

Thanks, Bugra