Objects addressed by id
The app stores notes and serves them at /app/note?id=N. Read note 2:
curl -s 'http://127.0.0.1:8080/app/note?id=2'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/note?id=2' [bob] Reminder: buy milk.
You get the note back. The app looked up the record purely from the id you supplied. Nothing checked whether that note is yours.