Items bought for free due to lacks of quantity controls
High
R
Reverb.com
Submitted None
Actions:
Reported by
nadino
Vulnerability Details
Technical details and impact analysis
Hi,
The server fails to check the quantity of the items that are going to be sell. Values <= 0 are accepted as 1.
PoC:
Go here
https://sandbox.reverb.com/fr/item/139897-fender-2-strap-leather-test-2018-leather
Intercept the response after clicking "Add to cart" and put "quantity: 0"
{F302179}
Proceed to checkout
{F302180}
Place order
{F302181}
{F302182}
I used one of the fake credit cards you provide us.
## Impact
Items are sold gratis
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Business Logic Errors