Lab: Excessive trust in client-side controls
Summary: PortSwigger's Web Security Academy lab demonstrates a purchasing workflow that fails to validate user input, letting a logged-in user buy a "Lightweight l33t leather jacket" for an unintended price. The POST /cart request carries a price parameter, and changing it to an arbitrary integer in Burp Repeater changes the cart price to match, allowing the order to complete below available store credit.
Why it matters: The price of an item is set by the client and accepted by the server, so anyone with a proxy and a login can name their own price on any order that relies on the same pattern.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026