312-50 Question 301
Single answer▪ Web App ThreatsDuring an authorized assessment of an e-commerce web application, you observe that after a user adds items to the cart, the application sends a POST request to /checkout/confirm with parameters including order_id, shipping_address, and total_amount. By intercepting the request in a proxy and changing total_amount from 499.99 to 4.99, the server accepts the modified value and completes the purchase at the lower price. Which vulnerability best describes this issue?
- A
Cross-Site Request Forgery (CSRF), because the application accepts forged state-changing requests
- B
Parameter tampering, because client-supplied values are trusted without proper server-side validation
- C
Session fixation, because the attacker can control the victim's authenticated session state
- D
SQL injection, because altering numeric input changes how the backend database processes the order
Show answer and explanation
Correct answer: B
Explanation
The best answer is parameter tampering. This web app threat occurs when an attacker modifies parameters exchanged between client and server to alter application behavior, often affecting prices, quantities, account identifiers, or privilege flags. In this case, the application should never trust the client-provided total_amount for final payment processing. Instead, the server should recalculate the total based on authoritative product and pricing data stored server-side. This aligns with OWASP guidance on secure design, input validation, and protecting against business logic abuse. OWASP Web Security Testing Guide and OWASP Top 10 principles emphasize that hidden fields, cookies, and request parameters are fully under attacker control and must be validated or ignored for security-sensitive decisions. A proper remediation would include server-side recalculation of order totals, integrity checks on business-critical values, and logging/alerting for suspicious price manipulation attempts.
- A. Incorrect.
Incorrect. CSRF involves tricking an authenticated user’s browser into sending an unwanted request to a vulnerable application. In this scenario, the tester is directly modifying a legitimate request parameter in transit using an intercepting proxy. The core problem is not a missing anti-CSRF control, but the server trusting a client-provided price value.
- B. Correct.
Correct. This is a classic parameter tampering issue, also called web parameter manipulation. The application relies on client-supplied data such as total_amount instead of recalculating or validating it on the server. In secure web applications, price, discounts, roles, and other security-sensitive values must be derived and enforced server-side, not trusted from hidden fields, cookies, or intercepted requests.
- C. Incorrect.
Incorrect. Session fixation occurs when an attacker sets or predicts a session identifier and causes the victim to authenticate with that known session ID. Nothing in the scenario involves controlling or fixing the session token. The vulnerability is tied to manipulation of business-critical request parameters, not session establishment.
- D. Incorrect.
Incorrect. SQL injection occurs when untrusted input is incorporated into SQL queries in an unsafe way, allowing query manipulation. Although the changed value is numeric, the scenario does not show evidence of database query manipulation. The observed impact comes from business logic trusting modified client input, which is distinct from SQL injection.