Web Mass Assignment Vulnerabilities

This vulnerability arises due to parameters not being whitelisted/blacklisted.

Sample attack scenario:

Original Request:

{ "user" => { "username" => "hacker", "email" => "[e-mail]" } }

Modified Request:

{ "user" => { "username" => "hacker", "email" => "[e-mail]", "admin" => true } }