Cheesy Does It

Had a bad day today, so I sure could use a pizza. Lucky me got exactly what I wanted with the hint IDOR.

After the usual clicking around and ordering a random pizza, I went to check on my orders. There I noticed that the GET request was with a pretty predictable ID.

So I created another account, and ordered a pizza on that account. Because my first order was with the ID 1, I was pretty confident the first order on my other account would be 2.

When I took that same request and changed the ID to 2, I could see the order of my second account with the JWT of my first account.

Besides knowing that my second account apparently likes a good old Meat Lovers pizza 🍕, I also got the flag 🇧🇪.