Context#

Workflows pass productId, plan, or shippingMethod as hidden inputs. If the fulfillment job reads those fields without re-validating ownership and availability, an attacker can substitute a premium SKU at base price.

Theory#

Treat business parameters as hints: always re-fetch authoritative rows by ID on the server before commit.

Practice#

• Complete a purchase for a cheap item; intercept the final POST and swap identifiers for an expensive SKU in a lab catalog.

Tools#

• Burp Suite