Yes, certainly. There's Insecure Object Mapping, which is a more general term for "Mass Assignment" in @m1ke's answer.
In your case it may be possible to exploit the application by including two
https://www.example.com?number=1&number=2 (this is a GET, but the same applies for POST).
it all depends on how the application handles it. Some frameworks may make the first parameter available to the application (
1), some may make the second available (
2) and some may provide both (
1,2). However, the latter is often equivalent of the query string simply being
Where a vulnerability could lie is if the query string is parsed in two different ways at different points. For example an authorisation script may be written using one framework that checks whether the current user has permission to access the
number provided. This framework takes the first query string value (
1). However, the framework that handles the
number for backend processing takes the last
number provided (
2), giving an attacker a way to bypass the authorisation check.
As you say, it may be possible for an exploit to exist where there is a large single query string value, or that there are many parameters provided. Any vulnerabilities here would likely to be down to the web server and server side technology stack itself and there have been such exploits discovered.