An attacker has been successfully modifying the purchase price of items purchased on the company's web site. The security administrators verify the web server and Oracle database have not been compromised directly. They have also verified the Intrusion Detection System (IDS) logs and found no attacks that could have caused this. What is the mostly likely way the attacker has been able to modify the purchase price?

Question

Quizplus · Accepted Answer

The attacker is likely modifying hidden form values in the web application to change the purchase price before submission, as this does not require compromising the server or database directly.

An Attacker Has Been Successfully Modifying the Purchase Price of Items