Loading HuntDB...

Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

Low
Z
Zomato
Submitted None
Reported by 0xdekster

Vulnerability Details

Technical details and impact analysis

Violation of Secure Design Principles
Hi Team I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by maximum of 1rs. POC - 1-Goto - zomato.com 2 - Add anything to your cart 3- At the checkout page , Add some money to Support Riders , click on any 25,50,100 4- Intercept the request of adding support rider money. 5- Change the price of Support Rider to " -0.99" in both fields of donation money. 6- Forward the request , the Cart value will change. 7- Pay by any platform, order will get placed. Thanks ## Impact Price Manipulation in Support Rider

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Violation of Secure Design Principles