idor cwe - sql injection cwe

Specification: incorrect privileges, permissions, ownership, etc. pp cwe cantik are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user) This action could be performed by the program or the administrator