Web Parameter Tampering attack is based on manipulation of parameters exchanged between client and server in order to modify application data, such as user credentials, permissions, price, etc.
Usually, this information is stored in cookies, hidden form fields, or URL Query Strings, and is used to increase application functionality and control.
Consider a user who can select form field values (combo box, check box, etc). When these values are submitted by the user, they could be acquired and arbitrarily manipulated by an attacker.
Example 2: Hidden form fields
<input type="hidden" id="1008" name="cost" value="70.00">http://vulnsite.com/default.asp?profile=741&debit=1000
An attacker could tamper with the URL, using other values for profile and/or debit.