Really? How is this exotic? Simple inspection of the rails form will reveal attribute and model names. And as Homarov proves, you don't need to even leave the friendly interface of the inspector to POST what you want.

The only reason why a cracker hasn't tried this is because it seems too simple to work.