Client Controlled Action Type Manipulation via Parameter Tampering

Variants:
Direct Session 

Vector Operation Method:
Bypass the privilege enforcement in the application by changing an action identifier controlled using client originating parameters, in order to cause another privileged operation to be performed. Examples may include changing view actions to delete actions, to insert actions, etc.