Which vulnerability involves modifying URL parameters to reflect changes on the web page?

Which vulnerability involves modifying URL parameters to reflect changes on the web page?

• A. Web Parameter Tampering
• B. Cross-Site Scripting
• C. SQL Injection
• D. Directory Traversal

Answer: (A)

Modifying the values in a web page’s URL query string to change what the page shows is a parameter tampering vulnerability. This happens when the application trusts client-provided data in the URL and uses it to drive logic or data access without validating those inputs on the server. For example, if a page displays details based on an id in the URL, changing that id to a different value can reveal a different product, alter prices, or access data the user shouldn’t see. The risk is that user-controlled parameters influence server behavior, so proper server-side validation, authorization checks, and strict handling of query parameters are essential defenses. This differs from other flaws like cross-site scripting, where an attacker injects malicious scripts into pages; SQL injection, where crafted input alters database queries; or directory traversal, where path inputs access files on the server. Each of those exploits a different weakness, whereas parameter tampering centers on manipulating URL parameters to affect what the server returns or how it behaves.

Modifying the values in a web page’s URL query string to change what the page shows is a parameter tampering vulnerability. This happens when the application trusts client-provided data in the URL and uses it to drive logic or data access without validating those inputs on the server. For example, if a page displays details based on an id in the URL, changing that id to a different value can reveal a different product, alter prices, or access data the user shouldn’t see. The risk is that user-controlled parameters influence server behavior, so proper server-side validation, authorization checks, and strict handling of query parameters are essential defenses.

This differs from other flaws like cross-site scripting, where an attacker injects malicious scripts into pages; SQL injection, where crafted input alters database queries; or directory traversal, where path inputs access files on the server. Each of those exploits a different weakness, whereas parameter tampering centers on manipulating URL parameters to affect what the server returns or how it behaves.