logic flaw report
Challenge:
Navigate to the following to tackle the question for the task:
While testing the cart workflow I intercepted the Add to cart / Update cart request in Burp, modified the item price from 100 to 10, forwarded the request, then applied coupon DISCOUNT10 and completed checkout. The order was accepted at the tampered price — demonstrating insufficient server-side validation of price/coupon and allowing attackers to pay less than intended.
Vulnerability
Insecure direct object/parameter manipulation — price integrity not enforced on the server.
The application trusts price information supplied by the client (HTTP request body/parameters). An attacker can modify the price parameter before it reaches the server and the server will accept it and process an order using the supplied value.
Root cause: server relies on client-supplied price rather than deriving item price from a trusted server-side source (database, product catalog) or using signed prices.
I added item to cart and captured the request on burpsuite
I changed the price from 100 to 10 and forwarded the request
Price changed on the cart successfully
I applied the coupon DISCOUNT10 and purchased
Pawned successfully
Impact
Attackers can purchase items for less (financial loss).
Coupon stacking / abuse may be possible (apply coupons after lowering price).
Reputational / business loss if exploited at scale.