Price Manipulation Vulnerability

Detects e-commerce logic that trusts client-submitted prices instead of server-side calculation.

zakirkun Updated

File contents

Price Manipulation Vulnerability

Overview

Price manipulation occurs when an application trusts the price submitted by the client (in request body or form fields) instead of calculating it server-side from the product catalog. Attackers can submit negative prices, zero prices, or arbitrarily low prices.

Remediation

  • NEVER trust client-submitted prices
  • Always calculate price server-side from the product ID and current catalog
  • Validate total = sum of (server_price × quantity) before processing payment

zakirkun/ice-tea/tree/main/skills/business-logic/price-manipulation commit e8320372d4

Frequently asked questions

npx skillmds@latest add zakirkun/price-manipulation-vulnerability