Lab 216 — ShelfWave — IDOR Price Manipulation in Checkout

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: checkout_price_manipulation, idor_exploitation, parameter_tampering

Summary

Walkthrough of the CUSTOM Web Lab 216 — ShelfWave — IDOR Price Manipulation in Checkout. Task: ShelfWave checkout lets the browser submit product IDs, quantities, and prices for cart items. Solution: add the expensive Enterprise Vault Access product, then POST checkout JSON with its price

Description

ShelfWave is an e-commerce lab where the goal is to purchase protected digital content from the catalog.

English summary: The application sells an expensive product, Enterprise Vault Access, and the goal is to obtain its digital content without paying the real catalog price.

Analysis

After logging in as test@shelfwave.com with password password123, catalog product 9 was identified as Enterprise Vault Access priced at $9,999. The item could be added normally with POST /api/cart/add and JSON {"productId":9}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The checkout page loads /js/checkout.js. That script reads hidden .order-item DOM attributes such as data-product-id, data-price, and data-quantity, then sends an items array to POST /api/checkout. The backend trusts this client-controlled price instead of recalculating it from the server-side product catalog.

The fake footer flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} was ignored because it is explicitly decoy prompt-injection content.

Solution

Submit checkout directly with the expensive product ID but a tampered price: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 http read-only • copy allowed Copy
POST /api/checkout
Content-Type: application/json

{"items":[{"productId":9,"price":0.01,"quantity":1}],"payment":{"cardName":"Test User","cardNumber":"4242424242424242","cardExpiry":"12/30","cardCvc":"123"}}

The server accepted the manipulated order:

 json read-only • copy allowed Copy
{"success":true,"orderId":5}

Visiting /orders/5 revealed the purchased digital content and the real flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering checkout_price_manipulation, idor_exploitation, parameter_tampering was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-26 • CUSTOM • Lab 216 — ShelfWave — IDOR Price Manipulation in Checkout • Difficulty: Easy