Comment by thaumasiotes

> It sounds like there were two separate problems:

> The first was that 123456 was the credentials for the admin panel.

No. 123456 was the credentials for the test setup, which contained nothing. But you could use the IDOR to access data from the test setup.

If 123456 had been the credentials to the admin panel, there would have been no point in exploiting an IDOR - as an admin, you can just look at whatever you want.