{"id":"https://openalex.org/W4415709652","doi":"https://doi.org/10.1109/asyu67174.2025.11208347","title":"Chained Exploitation of Metadata Leakage and IDOR: A Case Study in Weak Access Control","display_name":"Chained Exploitation of Metadata Leakage and IDOR: A Case Study in Weak Access Control","publication_year":2025,"publication_date":"2025-09-10","ids":{"openalex":"https://openalex.org/W4415709652","doi":"https://doi.org/10.1109/asyu67174.2025.11208347"},"language":"en","primary_location":{"id":"doi:10.1109/asyu67174.2025.11208347","doi":"https://doi.org/10.1109/asyu67174.2025.11208347","is_oa":false,"landing_page_url":"https://doi.org/10.1109/asyu67174.2025.11208347","pdf_url":null,"source":{"id":"https://openalex.org/S4363608363","display_name":"Innovations in Intelligent Systems and Applications Conference (ASYU)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 Innovations in Intelligent Systems and Applications Conference (ASYU)","raw_type":"proceedings-article"},"parent_works":[],"lineage":["https://openalex.org/W4415709652"],"child_works_count":0,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5093059061","display_name":"Tu\u011fberk Kocatekin","orcid":"https://orcid.org/0000-0001-6171-0135","observed_orcids":["https://orcid.org/0000-0001-6171-0135"]},"institutions":[{"id":"https://openalex.org/I50627504","display_name":"Istanbul Arel University","ror":"https://ror.org/03natay60","country_code":"TR","type":"education","lineage":["https://openalex.org/I50627504"]}],"countries":["TR"],"is_corresponding":true,"raw_author_name":"Tu\u011fberk Kocatekin","raw_affiliation_strings":["Istanbul Arel University,Department of Computer Engineering,Istanbul,T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Istanbul Arel University,Department of Computer Engineering,Istanbul,T\u00fcrkiye","institution_ids":["https://openalex.org/I50627504"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5093059061"],"corresponding_institution_ids":["https://openalex.org/I50627504"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12601","display_name":"Web Applications and Data Management","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/information-disclosure","display_name":"information disclosure","score":0.8309999704360962},{"id":"https://openalex.org/keywords/sensitive-personal-information","display_name":"sensitive personal data","score":0.6439999938011169},{"id":"https://openalex.org/keywords/api-design","display_name":"API design","score":0.49300000071525574},{"id":"https://openalex.org/keywords/authorization-mechanisms","display_name":"authorization mechanisms","score":0.8999999761581421},{"id":"https://openalex.org/keywords/vulnerability-disclosure","display_name":"vulnerability disclosure","score":0.781000018119812},{"id":"https://openalex.org/keywords/security-testing","display_name":"security testing","score":0.6259999871253967},{"id":"https://openalex.org/keywords/web-application-security","display_name":"web application security","score":0.6830000281333923}],"concepts":[{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6991999745368958},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.6891000270843506},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6851000189781189},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.6114000082015991},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5964000225067139},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.57669997215271},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5758000016212463},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.5223000049591064},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.41110000014305115},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.39570000767707825},{"id":"https://openalex.org/C1304207","wikidata":"https://www.wikidata.org/wiki/Q7189582","display_name":"Physical access","level":3,"score":0.3849000036716461},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.3772999942302704},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.3767000138759613},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.37310001254081726},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.3569999933242798},{"id":"https://openalex.org/C2779886121","wikidata":"https://www.wikidata.org/wiki/Q288682","display_name":"XACML","level":3,"score":0.3513999879360199},{"id":"https://openalex.org/C44415380","wikidata":"https://www.wikidata.org/wiki/Q17008721","display_name":"Computer access control","level":3,"score":0.34369999170303345},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3409999907016754},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.33090001344680786},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3303999900817871},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.32710000872612},{"id":"https://openalex.org/C169093310","wikidata":"https://www.wikidata.org/wiki/Q3702971","display_name":"Personally identifiable information","level":2,"score":0.3203999996185303},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3179999887943268},{"id":"https://openalex.org/C107101626","wikidata":"https://www.wikidata.org/wiki/Q842234","display_name":"Full disclosure","level":2,"score":0.3116999864578247},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3116999864578247},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.3075999915599823},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.30230000615119934},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.28780001401901245},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.28630000352859497},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.28369998931884766},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.2831999957561493},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.2766999900341034},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.2754000127315521},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.27480000257492065},{"id":"https://openalex.org/C2776543384","wikidata":"https://www.wikidata.org/wiki/Q593289","display_name":"Information access","level":2,"score":0.26899999380111694},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.25870001316070557},{"id":"https://openalex.org/C14982408","wikidata":"https://www.wikidata.org/wiki/Q11006334","display_name":"Network Access Control","level":4,"score":0.257099986076355},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.25270000100135803}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/asyu67174.2025.11208347","doi":"https://doi.org/10.1109/asyu67174.2025.11208347","is_oa":false,"landing_page_url":"https://doi.org/10.1109/asyu67174.2025.11208347","pdf_url":null,"source":{"id":"https://openalex.org/S4363608363","display_name":"Innovations in Intelligent Systems and Applications Conference (ASYU)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 Innovations in Intelligent Systems and Applications Conference (ASYU)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W3007797095","https://openalex.org/W3180644890","https://openalex.org/W4312286091","https://openalex.org/W4313479771","https://openalex.org/W4387713364","https://openalex.org/W4388857107","https://openalex.org/W4392254992"],"related_works":["https://openalex.org/W4312286091","https://openalex.org/W6949282556","https://openalex.org/W4405940381","https://openalex.org/W7127601590","https://openalex.org/W3189374565","https://openalex.org/W7202347874","https://openalex.org/W7154888385","https://openalex.org/W4380523499","https://openalex.org/W7203945250","https://openalex.org/W6968170461"],"abstract_inverted_index":{"This":[0,84],"paper":[1],"presents":[2],"a":[3,8,12],"real-world":[4],"case":[5,85],"study":[6],"of":[7,36,89,134],"critical":[9],"vulnerability":[10,136],"in":[11,17,93,123],"large-scale":[13],"web":[14],"application":[15],"deployed":[16],"T\u00fcrkiye.":[18],"The":[19],"platform,":[20],"which":[21,95],"manages":[22],"sensitive":[23,97],"personal":[24],"data":[25,98],"across":[26],"various":[27],"domains,":[28],"was":[29],"found":[30],"to":[31,34,60],"be":[32],"susceptible":[33],"combination":[35],"Insecure":[37],"Direct":[38],"Object":[39],"Reference":[40],"(IDOR)":[41],"and":[42,70,76,78,99,110,127],"information":[43,63],"disclosure":[44],"flaws.":[45],"Individually,":[46],"these":[47],"vulnerabilities":[48,73],"poses":[49],"limited":[50],"risk.":[51],"However,":[52],"when":[53],"chained":[54],"together,":[55],"they":[56,128],"enabled":[57],"unauthorized":[58],"access":[59,66],"private":[61],"user":[62],"through":[64],"inadequate":[65],"controls.":[67],"Using":[68],"ethical":[69],"controlled":[71],"methods,":[72],"are":[74],"identified":[75],"disclosed,":[77],"later":[79],"patched":[80],"by":[81],"the":[82,87,101,132],"organization.":[83],"highlights":[86],"importance":[88,133],"security":[90,125],"testing,":[91],"especially":[92],"applications":[94],"handle":[96],"emphasizes":[100],"need":[102],"for":[103,131],"secure":[104],"software":[105],"architecture,":[106],"robust":[107],"authorization":[108],"mechanisms":[109],"careful":[111],"API":[112],"design.":[113],"Our":[114],"findings":[115],"demonstrate":[116],"that":[117],"small":[118],"things":[119],"combined":[120],"can":[121],"result":[122],"significant":[124],"breaches,":[126],"call":[129],"attention":[130],"structured":[135],"response":[137],"processes.":[138]},"counts_by_year":[],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2025-10-30T00:00:00"}