springboot-openai-chatgpt IDOR

## intro

Create a new user while specifying a nonexistent expire field to gain membership privileges. You can learn about the existing fields in the data table through the error messages.

## POC

When we create a new account int the system, we can add a new filed called ·expire_time·, with this field, we can access the VIP statement and use the VIP methods.

these fields can be found by the error msg returned by the backend. with these error msgs, we can write the correct expite_time key and value. 

 For detail, the code is following

 

## Result

IDOR, with the logic error, we can access the VIP authorizations.