#0203
Your e-commerce checkout API accepts an order object from the client that includes productId, quantity, and — dangerously — price. The order handler trusts the client-supplied price instead of looking up the authoritative value from the product catalog.
An attacker intercepts the checkout request and sets price to 0.01, purchasing any item for a fraction of a cent. The server dutifully calculates a total of 0.01 × quantity and charges accordingly.
Client-side price tampering costs businesses real revenue. Every major bug-bounty programme includes this class of vulnerability, and it has caused million-dollar losses at real retailers.
createOrder('u1', { productId: 'p1', quantity: 1, price: 0.01 }, catalog)// returns { unitPrice: 99.99, total: 99.99 }