Cheesy Does It - Broken Logic in the Refund Request

This writeup is for the daily challenge on Bugforge.io.

Application Analysis

First, I checked if the vulnerability was a broken logic bug in the POST /api/orders request. I had already written a writeup for this application and remembered the vulnerability, so I tried again. Although I successfully ordered a free pizza, this was not the bug that would give me the flag for today’s daily challenge.

After the pizza status changed to “Delivered,” the UI revealed a report functionality allowing users to request a refund.

Cheesy Does It Refund Request

This endpoint is also discoverable within the JavaScript source. To test this, I used Jason Haddix’s endpoints bookmarklet.

Vulnerability Discovery

Looking at the request in Caido, I noticed that the refund_amount is specified in the request body. My first instinct was to manipulate the amount to a higher value than what I initially paid.

Cheesy Does It Refund Request Caido

I modified the value and sent the request again. The refund request processed successfully and I got the flag!