hi.
I am using Burp Suite app for security testing and I found a vulnerability, can someone help me?The scenario is as follows:
① I have 2 users (user A, user B) sharing 1 role (on the same screen)
user A only sees data Contact A
user B only sees data Contact B
Database:
② I have a action create data with the parameters are Contact(Id, HouseNo, City) and User_ID.
③ User A with User_ID = 50, create data but in the app Burp Suite, I changed parameter User_ID = 57
As a result, User B can see the data created by User A.
Is there any way to Prevent Parameter Tampering?
thanks and best regard.
Hello @Dang QuyenTo prevent parameter tampering in your scenario you can follow these steps:
Server-Side Validation: Always validate User_ID on the server side. Compare it with the logged-in user's ID from getuserid() function and ensure it matches.
if possible Remove User_ID from the client: Don't allow User_ID to be passed from the client. Retrieve it directly in server action using getuserid() function.
Thanks
Regards ,
Gourav Shrivastava
Thank you @Gourav Shrivastava.