Lab: Exploiting a mass assignment vulnerability
Summary: PortSwigger's lab walks through exploiting a mass assignment vulnerability in an e-commerce checkout API, where the GET response for /api/checkout exposes a chosen_discount parameter absent from the POST request. Adding chosen_discount to the POST body is accepted without error, and setting its percentage to 100 lets the user buy a Lightweight l33t Leather Jacket using the wiener:peter account.
Bottom line: The API silently accepted a field the client was never meant to send, and a single percentage value was enough to zero out the price - the same pattern that lets an attacker set roles, credits, or approval flags on any endpoint that binds request JSON directly to internal objects.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026