Category: Business Logic Vulnerability / Broken Access Control (OWASP A01:2021)
Summary
During security testing of an e-commerce application, I discovered that the checkout/order API endpoint did not properly validate the relationship between product_id and the corresponding price/total fields sent in the request payload. This allowed an attacker to purchase a high-value product while being charged the price of a low-value product.
Initial Challenge — Bypassing Payload Encryption
When I first attempted to intercept and modify the checkout request, I found that the payload was encrypted, making direct manipulation via Burp Suite ineffective. To understand the encryption mechanism, I inspected the application's client-side code using Chrome's remote debugging feature (chrome://inspect/#devices), which allowed me to trace how the app handled encryption on the frontend.
