The web application does not sufficiently verify inputs that
					are assumed to be immutable but are actually externally controllable, such as
					hidden form fields.If a web product does not properly protect assumed-immutable values from
						modification in hidden form fields, parameters, cookies, or URLs, this can
						lead to modification of critical data. Web applications often mistakenly
						make the assumption that data passed to the client in hidden fields or
						cookies is not susceptible to tampering. Improper validation of data that
						are user-controllable can lead to the application processing incorrect, and
						often malicious, input. For example, custom cookies commonly store session data or persistent
						data across sessions. This kind of session data is normally involved in
						security related decisions on the server side, such as user authentication
						and access control. Thus, the cookies might contain sensitive data such as
						user credentials and privileges. This is a dangerous practice, as it can
						often lead to improper reliance on the value of the client-provided cookie
						by the server side application.