IDOR Explorer

Challenge Question

This internal billing tool lets any logged-in employee pull up an invoice by its ID in the URL. Nothing on the server checks whether the invoice you're asking for is actually yours. See what other invoices are sitting there waiting to be read.