# Chaining IDOR Vulnerabilities

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fi3Y2incHimamlv2sD0HK%2Fimage.png?alt=media&#x26;token=357646cf-42df-492a-993f-ff0147193d68" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fx5afo046ylJlWntJZi5D%2Fimage.png?alt=media&#x26;token=66435271-15db-4039-8882-d8ba189e6c45" alt=""><figcaption></figcaption></figure>

Intercept the update profile&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FPAfjjsomvA9cDUvB6ZEP%2Fimage.png?alt=media&#x26;token=138af383-a991-4742-877a-fd90f1c74b00" alt=""><figcaption></figcaption></figure>

Send it to repeater > change request method from POST to GET

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F3OgbpSiG0FvSt83f4B6L%2Fimage.png?alt=media&#x26;token=97b8ce57-1c23-4623-97ff-10812febd06f" alt=""><figcaption></figcaption></figure>

Send it to intruder

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fk8vbZh0pBGwR8U8soE8R%2Fimage.png?alt=media&#x26;token=2343016c-6f79-485c-8856-415e315bdd82" alt=""><figcaption></figcaption></figure>

We can see the staff\_admin here

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FW1e1EQqeCWTohDWVGniP%2Fimage.png?alt=media&#x26;token=fdad9dfb-257f-4ec9-b710-b2b09abc8547" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F5Qdd8Rn3Unyf5z2oMPVZ%2Fimage.png?alt=media&#x26;token=5b258c65-57c7-47f1-97ad-725b03f043cd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FgZaMAfwyrE8ZI6cwsDlz%2Fimage.png?alt=media&#x26;token=a504d1a2-f980-4c8f-b5bf-3cae3bd87d7b" alt=""><figcaption></figcaption></figure>

\+

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fves40mNTgyhGEgTn4Cwv%2Fimage.png?alt=media&#x26;token=3eeec199-7d57-4d57-b469-0e26122dd291" alt=""><figcaption></figcaption></figure>

Change the admin email&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FonOcC0e7VPlDGOZrUumA%2Fimage.png?alt=media&#x26;token=14a0def8-8d00-4bce-97b5-4bd4e3ba0f9d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F9L8tWezbVk0r4MAS1xdo%2Fimage.png?alt=media&#x26;token=c06ad999-afa8-4bbc-912c-0544568f49b6" alt=""><figcaption></figcaption></figure>

