Parameter Tampering

Also Known As

TL;DR

Explanation

Parameter tampering exploits the application's trust in client-supplied values: changing price=10 to price=1 in a POST body, altering a hidden field discount_pct=0 to 100, or editing a cookie with role=user to role=admin. These attacks succeed when the application validates parameter format (is it an integer?) but not legitimacy (is this integer the correct price?). Defences: derive prices, roles, and permissions server-side from authoritative sources; use HMAC-signed tokens for values that must round-trip through the client; never trust the client for security-sensitive state.

Common Misconception

Why It Matters

Common Mistakes

• Storing the price in a hidden form field and trusting it on submission instead of re-fetching from the database.
• Only validating parameters in client-side JavaScript — bypassed by intercepting the request.
• Using sequential integer IDs for private objects without authorisation checks — increment by 1 to access another user's data.
• Not re-validating quantity, price, or discount constraints server-side after any user-modifiable input.

Code Examples

$price = (float) $_POST['price']; // client controls the price

$price = Product::findOrFail((int)$_POST['product_id'])->price; // always from DB

References

• ↗ https://owasp.org/www-community/attacks/Web_Parameter_Tampering

Tags

Related Terms