Which of the following is an example of improper access control?

Which of the following is an example of improper access control?

• A. Insecure direct object references
• B. Cross-site scripting
• C. Directory traversal
• D. SQL injection

Answer: (A)

Improper access control happens when an application does not adequately verify that a user should be allowed to access a requested resource. A classic example is insecure direct object references, where the app uses a direct reference to an internal object (like an ID in the URL or a parameter) and only trusts the client to supply it without checking the caller’s permission. If an attacker changes the reference (for example, swapping an ID in the request), they can access another user’s data or a resource they shouldn’t see because the server didn’t enforce proper authorization for that object. Cross-site scripting isn’t about access to resources; it’s about injecting and executing malicious scripts in another user’s browser, which is an input/output security issue rather than an access-control enforcement problem. Directory traversal targets the file system by manipulating paths to reach restricted files, which is more about path handling and file access than about validating per-user permissions for resources. SQL injection is about manipulating database queries to alter or extract data, which is a code-injection vulnerability affecting data handling rather than whether a user is authorized to access a given object.

Improper access control happens when an application does not adequately verify that a user should be allowed to access a requested resource. A classic example is insecure direct object references, where the app uses a direct reference to an internal object (like an ID in the URL or a parameter) and only trusts the client to supply it without checking the caller’s permission. If an attacker changes the reference (for example, swapping an ID in the request), they can access another user’s data or a resource they shouldn’t see because the server didn’t enforce proper authorization for that object.

Cross-site scripting isn’t about access to resources; it’s about injecting and executing malicious scripts in another user’s browser, which is an input/output security issue rather than an access-control enforcement problem. Directory traversal targets the file system by manipulating paths to reach restricted files, which is more about path handling and file access than about validating per-user permissions for resources. SQL injection is about manipulating database queries to alter or extract data, which is a code-injection vulnerability affecting data handling rather than whether a user is authorized to access a given object.