(BAC)User ID controlled by request parameter

firstly we explain what of the User ID controlled by request parameter???

The problem here is that the developer made the User ID controllable through the Request Parameter, so an attacker can change the ID value (whether it's a number or a username) to access another user's data. Because the server doesn't verify that the current user is authorized to access this ID (authorization), it displays the other user's data.

okay her we go solve lab

After login we found it

Let's change Parameter Name from Wiener to Carlos

like this

and her we go We get API KEY From Carlos

Submit Api like this to solved this lab

congrat we solved this lab

How to Fix

The solution to this vulnerability is for the developer to implement an authorization process on the server, which verifies that the current user has the necessary permissions to access the account they are requesting. If they do not have these permissions, the request is rejected, and a response such as 403 Forbidden is returned.

The Golden Rule

Never trust any User ID that comes from the client. The server must always verify that the current user is authorized to access the requested resource.