IDOR — Sequential Document IDs

DocuShare uses sequential numeric IDs for documents and only checks that you're logged in — not that you own the doc you're viewing. Find a way to read a document that isn't yours.

📖 Read the walkthrough: how this attack works, real-world cases and defences (solution behind a spoiler)