Lab: Finding and exploiting an unused API endpoint
Summary: PortSwigger's lab walks through finding an unused API endpoint by sending an OPTIONS request to /api/products/3/price, which reveals that GET and PATCH are allowed. After logging in as wiener:peter, the tester sends a PATCH to /api/products/1/price with Content-Type application/json and the body {"price":0}, which sets the leather jacket's price to $0.00 and lets the order be placed.
Key Takeaway: The endpoint accepted a client-supplied price with no authorization check beyond a login, so anyone with an account could set any product's price to zero - a reminder that an undocumented PATCH method on a pricing API is a direct path to revenue loss.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026