Title
IDOR on course enrollment/resource access via predictable IDs on kurs.onecode.de
Target
kurs.onecode.de
Class
IDOR
Confidence
60/100
Reasoning
Course platforms typically use numeric/UUID resource IDs (course_id, user_id, enrollment_id). Railway backend suggests REST/GraphQL API. No auth on passive probe but 307 to /login implies protected resources.
Evidence needed
Authenticated session; API endpoints accepting id/uid/course_id/enrollment_id params; cross-user access to enrollments/content
Verify steps
GET https://kurs.onecode.de/api/* (enumerate via JS source/Network tab); authenticated GET /api/courses/{id} with other users' IDs; check for /api/v1, /api/v2, /graphql endpoints
Impact
Cross-tenant PII dump, unauthorized course access, enrollment manipulation — HIGH
Testability
AUTH_HELPED
model: nemotron3 · auto-synced from leads/lead-*.md
Title
IDOR on course enrollment/resource access via predictable IDs on kurs.onecode.de
Target
kurs.onecode.deClass
IDOR
Confidence
60/100
Reasoning
Course platforms typically use numeric/UUID resource IDs (course_id, user_id, enrollment_id). Railway backend suggests REST/GraphQL API. No auth on passive probe but 307 to /login implies protected resources.
Evidence needed
Authenticated session; API endpoints accepting id/uid/course_id/enrollment_id params; cross-user access to enrollments/content
Verify steps
GET https://kurs.onecode.de/api/* (enumerate via JS source/Network tab); authenticated GET /api/courses/{id} with other users' IDs; check for /api/v1, /api/v2, /graphql endpoints
Impact
Cross-tenant PII dump, unauthorized course access, enrollment manipulation — HIGH
Testability
AUTH_HELPED
model: nemotron3 · auto-synced from leads/lead-*.md