Post Based IDOR Variant

Intercept request with Burp -call-history.php

Change phone_num=[target phone number]

Other number’s call history is shown