312-50 Question 119
Single answerTypesDuring a web application assessment, an ethical hacker reviews a login form that uses a hidden input field named role with the value user. After intercepting the POST request in a proxy, the tester changes role=user to role=admin and successfully gains administrative access without valid admin credentials. Which type of web vulnerability best describes this issue?
- A
Parameter tampering
- B
SQL injection
- C
Cross-site scripting (XSS)
- D
Session fixation
Show answer and explanation
Correct answer: A
Explanation
This scenario is a practical example of parameter tampering, sometimes discussed in CEH contexts as part of web application attacks involving manipulation of client-side controls. Hidden form fields are not a security boundary because users can alter them with intercepting proxies such as Burp Suite or OWASP ZAP. Secure design requires the server to enforce authorization decisions based on trusted server-side state rather than client-supplied values. This aligns with OWASP guidance that all client input, including hidden fields, cookies, and headers, must be treated as untrusted. The key lesson is that privilege or role information must never be accepted from the client without strict server-side validation and access control enforcement.
- A. Correct.
Correct. Parameter tampering occurs when an attacker modifies parameters exchanged between client and server, such as hidden form fields, cookies, or URL values, to alter application behavior. In this scenario, changing the hidden role parameter from user to admin directly manipulates trust placed in client-side input, which is a classic example of parameter tampering.
- B. Incorrect.
Incorrect. SQL injection involves injecting malicious SQL syntax into application inputs to manipulate backend database queries. Although poor server-side validation is present in this scenario, there is no indication that the attacker injected SQL commands or altered database queries.
- C. Incorrect.
Incorrect. Cross-site scripting (XSS) involves injecting client-side script, typically JavaScript, that executes in another user's browser. Here, the attacker is modifying a hidden parameter to escalate privileges, not injecting executable script into a page or response.
- D. Incorrect.
Incorrect. Session fixation is an authentication attack in which the attacker forces or predicts a victim's session identifier and then reuses it after login. This scenario does not involve controlling a session ID; it involves changing an authorization-related parameter in the request.