User ID controlled by request parameter with password disclosure 1 Access Control Vulnerabilities Lab 8 04/12/2024