Assume that a user logged in to a webpage with their own account, then makes a POST request and captures it. With some modification to the captured request, it is being executed. Sure. It goes through without any problems.
Is this a security issue on the development side? Because the modified POST request contains data, which is not on the database/server side. The user changes their name and address then to bypass some restrictions.
What should I look into to prevent this happening again? I do capture the IP of this user. But it seems to me, that we can do better to prevent it with our technical skill.