Checkout Logic Bugs

Scenario

ShopWave checkout posts item price in a hidden field the browser can edit. The server charges whatever price arrives in the form. Complete a purchase while paying zero.

Your approach

1. Add an item to cart and intercept the checkout POST.
2. Change the hidden price field to zero before submitting.
3. Complete the order and read the confirmation page.
4. Copy the price-tamper flag from the success message.
5. Submit that flag.