While testing a web application’s account settings feature, I came across an interesting case related to input validation.

What I Found

The application allowed users to update details such as:

City

State

Name

Phone

Postal Code

Street fields

By intercepting the request and modifying these parameters, I was able to submit arbitrary values like:

Vulnerable@123

The application accepted these values without any validation and stored them successfully. When revisiting the profile page, the same values were reflected exactly as submitted.

Why This Matters

At first glance, this might look like a low impact issue.…