Skip to content
ביקורת אבטחה
חזרה ללוח
D43אומת בקודP0

Price tampering: client `seatPrice` trusted verbatim → free/underpriced tickets

B · unauth-POSTS3 · destructiveSECT1
תיקון
85%
מורכבות medium

The checkout trusts the price sent by the browser, letting an attacker buy tickets for free or underpriced.

Checkout.php:417,383

תיק מלא
ממצאים קשורים
D13 · God-router: no nonce + no capability …D37 · Hardcoded payment bypass: `cc_id == 3…D45 · `ajax_seat_state` lets an anonymous u…D46 · `ajax_reassign_seat` has no capabilit…D48 · Seat reservation race (read-check-wri…D56 · Freebie threshold `intval($sum)<=1` s…