Exploiting a server-side validation failure in OopsSec Store 's checkout process to purchase products at arbitrary prices. OopsSec Store 's checkout sends the order total straight from the browser. The server saves whatever it receives without recalculating from actual product prices. Change it to a penny, the order goes through at a penny. Table of contents Lab setup From an empty directory: npx create-oss-store oss-store cd oss-store npm start Enter fullscreen mode Exit fullscreen mode Or with Docker (no Node.js required): docker run -p 3000:3000 leogra/oss-oopssec-store Enter fullscreen mode Exit fullscreen mode The app runs at http://localhost:3000 . Vulnerability overview When you buy something on OopsSec Store , the browser sends a POST to /api/orders with the cart items and a total field. That total is calculated by frontend JavaScript. The server takes it at face value and creates the order. The product prices are in the database. The server could look them up and do the math itself. It doesn't.…