The page parameter does not include proper data validation to ensure the values provided to it are whitelisted or contained to a prescribed list of acceptable values. By exploiting this weakness, we are able to dictate values to this parameter, which should not be allowed.