domains / families / security / hunt-mass-assignment

hunt-mass-assignment

separate

Hunt mass assignment via sensitive field injection and ORM framework exploitation.

When to use

• API accepts JSON/XML/form body with fields beyond what the UI exposes.
• User profile updates, registration, checkout, or resource creation endpoints.
• Framework ORMs (Rails ActiveRecord, Laravel Eloquent, Django ORM, Mongoose, Prisma) where bulk assignment is the default.
• PATCH endpoints that accept sparse updates — may skip per-field authorization.

Skill page

Source