(Un)predictable Databases

Task description

Ivica isn’t a fan of databases, but he needed one for his site. He’d rather style pages in HTML, so he gave the database little thought and made a single table for everything he cared about. He also dropped a few things in there that don’t belong, and never bothered to tidy up. He looked the database over later and saw no security problem.

The original was in Croatian; this is my translation.

The upload

The site has a file upload form. Upload anything and it returns a success message with a link to what you uploaded. The link looked like this:

view.php?id=10

The part after the ? is a parameter: a value the page reads to decide what to show. Here id=10 means “show entry number 10”. You can type a different number into the address bar yourself, and the page will show that entry instead.

Counting down

The task hints that the one table holds things that don’t belong together: uploads mixed in with whatever else Ivica kept. If entries are just numbered, earlier numbers might be those other things.

So we walked the id down from the top: id=9, id=8, and so on. At id=8 the page showed the flag.

This is called an insecure direct object reference, or IDOR. The page points straight at a database record by its number and shows it to anyone who asks, without checking whether that person should see it. The fix is for the server to confirm the visitor owns the record, or that it’s public, before returning it. Numbering records isn’t the problem; handing any of them to anyone who changes the number is.