An attacker has been successfully modifying the purchase price of items purchased at a web site. The security administrators verify the web server and Oracle database have not been compromised directly. They have also verified the IDS logs and found no attacks that could have caused this. What is the mostly likely way the attacker has been able to modify the price?
A. By using SQL injection
B. By changing hidden form values in a local copy of the web page
C. By using cross site scripting
D. There is no way the attacker could do this without directly compromising either the web server or the database