Attacker can add two free bags offered by the site at the same time.

A vulnerability was found on the website "███████" that allows an attacker to add two free bags offered by the site simultaneously, despite the restriction of choosing only one. This is achieved by manipulating the API responsible for adding the free bags to the cart.