Able to manipulate order amount by removing cancellation amount and cause financial impact

Summary

@sjvino identified an issue where it could have allowed to tamper the cancellation amount and pay less than the actual order amount.

Steps submitted by the researcher to reproduce the issue (maybe it will help new folks in the community to learn something out of it) -

• Select Items and add them to the cart
• Set a proxy and intercept the request before making the payment
• Select payment method and intercept the request, change the cancellation_amount parameter to 0, it will reduce the order amount and cancel all the previous cancellation charges on that account.

Regards, Zomato Security Team