We are developing a hybrid mobile application and for certain function calls, there is a url called. Here is a sample request for getting user information
http://someurl.com/1234/account
where: 1234 - is the user id in the database.
We figured that a "man in the middle attack" is possible for this. The url called by the mobile app can be sniffed, then the hacker just changed the value for the user id and with that he can see information for other users. The question is - would simply changing the url called to https solve this security flaw?
No, it will not. You are exposing user data based on an unauthenticated URL and it is trivial for unauthorized parties to access modified URLs even away from the mobile platform.