Framework offer handy mass-assignment features to lessen the workload for developers, these enable to insert a whole set of user-entered data from a form into an object or database. Is often used without a whitelist for protecting the fields from the user’s input.
Exploitation
Will often involve setting extra parameters in a POST request to the server to establish extra privileges or enable certain privileges.