I have a form that takes multiple input fields and makes an API request via GET.
The fields are not properly sanitizing input and I am able to add arbitrary parameters to the query string by submitting input such as
Instead of some sort of encoding, the resulting API query looks like
I cannot think of any malicious use to this, as anybody could just hit this endpoint directly or use a proxy to bypass any client side validation.
If you were performing an application review, is this something that might be worth calling out?