Certified Ethical Hacker (CEH) Practice Question

The scenario describes a situation where internal object references (such as account IDs) are exposed to the user. Because the server does not properly enforce authorization checks, an attacker can simply modify the ID value in the URL to access resources that belong to other users. This is known as an insecure direct object reference (IDOR). CSRF relies on a victim's browser submitting unwanted requests, clickjacking tricks a user into clicking hidden elements, and session fixation forces a user to operate under an attacker-chosen session ID. None of these involve manipulating resource identifiers to bypass authorization like IDOR does.