How a Second-Order IDOR Lets You Delete Other Users’ Posts, Profile Picture, and Cover Photo

Hey Geeks, It was a cool bug, so let’s skip the formalities and dive straight in. So, the target was a social media application, pretty standard stuff. Users could upload profile pictures, cover photos, and post images. For obvious confidentiality re...