HexBrain

Eternal · Report #927661

Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

Validstatus
lowseverity
21upvotes
8 Aug 2020disclosed

How it was found

Hi Team

I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by maximum of 1rs.

POC -

1-Goto - zomato.com 2 - Add anything to your cart 3- At the checkout page , Add some money to Support Riders , click on any 25,50,100 4- Intercept the request of adding support rider money. 5- Change the price of Support Rider to " -0.99" in both fields of donation money. 6- Forward the request , the Cart value will change. 7- Pay by any platform, order will get placed.

Thanks

Impact

Price Manipulation in Support Rider

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original