Client-Side Price Manipulation: Pay Whatever You Want at Checkout

Exploiting a server-side validation failure in OopsSec Store 's checkout process to purchase products at arbitrary prices. OopsSec Store 's checkout sends the order total straight from the browser. The server saves whatever it receives without recalculating from actual product prices. Change it to a penny, the order goes through at a penny. Table of contents Lab setup From an empty directory: npx create-oss-store oss-store cd oss-store npm start Or with Docker (no Node.js required): docker run -