An attack where the attacker changes parameters in requests to modify business logic, such as prices or permissions.

An attack where the attacker changes parameters in requests to modify business logic, such as prices or permissions.

• A. Cookie Tampering
• B. Parameter/Form Tampering Attack
• C. Unvalidated Input and File Injection Attacks
• D. SQL Injection Attacks

Answer: (B)

Modifying request parameters to influence how the system enforces business rules. In this kind of attack, the attacker alters values sent by the client—like the price, quantity, discount, or a user permission flag—in the request (query string, form fields, or hidden inputs) and tricks the server into applying different logic than intended. The key idea is exploiting trust in client-provided data to change outcomes such as cost, access level, or workflow steps. The server should not rely on these values without rechecking them on the server side; price and permissions must be validated and enforced by server code, not accepted from the client. This differs from cookie tampering, which targets state stored in cookies rather than the request parameters themselves. It also differs from unvalidated input and file injection attacks, which aim to inject malicious data that leads to code execution or file access, and from SQL injection, which manipulates database queries.

Modifying request parameters to influence how the system enforces business rules. In this kind of attack, the attacker alters values sent by the client—like the price, quantity, discount, or a user permission flag—in the request (query string, form fields, or hidden inputs) and tricks the server into applying different logic than intended. The key idea is exploiting trust in client-provided data to change outcomes such as cost, access level, or workflow steps. The server should not rely on these values without rechecking them on the server side; price and permissions must be validated and enforced by server code, not accepted from the client.

This differs from cookie tampering, which targets state stored in cookies rather than the request parameters themselves. It also differs from unvalidated input and file injection attacks, which aim to inject malicious data that leads to code execution or file access, and from SQL injection, which manipulates database queries.