Negative Quantity / Amount Manipulation

Detects shopping cart and transaction logic that accepts negative quantities or amounts, enabling credit manipulation.

zakirkun add7772 2 files · 2.1 KB Updated

File contents

Negative Quantity / Amount Manipulation

Overview

Without server-side validation that quantities and amounts must be positive, attackers can submit negative quantities to:

  • Receive a refund without returning items
  • Add negative-priced items to reduce total to zero or below
  • Earn loyalty points by creating and cancelling negative transactions

Remediation

  • Validate all quantity and amount fields are strictly positive (> 0)
  • Validate total order amount is positive before processing payment
  • Use unsigned integer types where possible

zakirkun/ice-tea/tree/main/skills/business-logic/negative-quantity commit add7772da3

Frequently asked questions

npx skillmds@latest add zakirkun/negative-quantity-amount-manipulation