Forced Browsing

Given below is the web page of an e-commerce website with an option to login as a seller. Using the credentials mentioned, check if any of the web pages are vulnerable to forced browsing

There is a login page but login is never checked. Hence we can manually visit the sellerinfo page and see any sellers infotmation:

Without loggin in, in incognito browser, simply visit the url:

http://url/sellerinfo/seller1.php

http://url/sellerinfo/seller2.php

http://url/sellerinfo/seller3.php

Details of seller is revealed

You do not have the credentials to the account given below. Can you look for some clue that lets you force browse into the account, without the credentials?

The screenshot shows the URL of the page after login.

We force browse that directly,

http://url/loggedin/home.php

And we see page after login as no login check is being done.