Parameter manipulation vulnerabilities allow the manipulation of parameters exchanged between a client and the server in order to modify application data, such as user credentials and permissions, price and quantity of products, and others. This information can be stored in cookies, in hidden form fields, or in URL query strings.
In the early days of online web stores, programmers made the costly mistake of coding the price of an article as a hidden form field in their HTML pages. Attackers would simply download the HTML file for the web store, change the price, and order with an enormous discount. This is a classic example of a parameter manipulation vulnerability.
Common attacks associated with parameter ...
