Price/Quantity Manipulation
Attackers modify price, quantity, discount, or other financial parameters in client-side requests to purchase items at reduced prices, apply unauthorized discounts, or manipulate order totals.
Overview
Price and quantity manipulation is a business logic vulnerability where attackers intercept and modify financial parameters (price, discount, quantity, shipping cost) in HTTP requests. Applications that trust client-submitted values for financial calculations are vulnerable to fraud, as attackers can purchase items for arbitrary prices.
Impact
Financial loss, inventory discrepancies, fraud, unauthorized discount application.
Examples
Price Modification
POST /api/checkout
{"item_id": "premium-plan", "price": 0.01, "quantity": 1}Remediation
Validate all financial calculations server-side, never trust client-submitted prices, implement order verification workflows, and log all transaction anomalies.
Calculate all prices, taxes, and totals server-side
Never trust client-submitted financial values
Validate prices against the product catalog on every request
Implement anomaly detection for unusual transactions
Log and alert on pricing discrepancies
Related SuperClue scanner checks
These scanner checks look for signs of Price/Quantity Manipulation. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works