I found vulnerability in a web app where I could manipulate URL parameters, i.e. take host/friends.php and then change it to host/friends.php?view=username and as a result see the users friends and subscriptions. Normally this view function is not provided by the web app's interface.

Now I would like to define this vulnerability using OWASP top 10 list, but I'm not too sure whether it is definition A5 or A7 or something else?

1 Answer 1


From the information you've provided it sounds like your issue would fit in to OWASP 2013 Top 10 under "A7 - Missing Function Level Access Control" as the application should apply an access control to restrict who can see that information but appears to be failing to do so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .