Question

An internal staff member logs into an ERP platform and clicks on a record. The browser URL changes to:

URL: =5&action=SELECT

Which of the following is the MOST likely vulnerability in this ERP platform?

A. Brute forcing of account credentials
B. Plain-text credentials transmitted over the Internet
C. Insecure direct object reference
D. SQL injection of ERP back end

Answer 1

The most likely vulnerability in an ERP platform when a URL changes to include parameters like 'URL: =5&action=SELECT' is an Insecure Direct Object Reference (IDOR). This security flaw could allow unauthorized access to different records by manipulating URL parameters.

Step-by-step explanation:

When an internal staff member logs into an ERP platform and the browser URL changes in a way that includes parameters such as, the most likely vulnerability is an Insecure Direct Object Reference (IDOR). This type of vulnerability occurs when an application provides direct access to objects based on user-supplied input. In this case, it is possible that an attacker could manipulate the URL parameters to access records they should not have access to, by changing the value after URL: to reference a different object. This does not directly suggest SQL injection, brute forcing of account credentials, or plain-text credentials transmitted over the Internet, which are distinct vulnerabilities requiring different conditions to be exploited.