Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim
Lab environment — not a production system
Screenshots and raw traffic are not translated; text within them may be in another language.
crAPI/Evidence/[PASS] Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim
01 — Notes
Test notes
Vulnerability
Description
Impact
CWE
OWASP
Scenario
Endpoint
Affected feature
Remediation
Proof of concept
View source note (English)
Vulnerability: [PASS] Unrestricted Access to Sensitive Business Flow - Shop - Coupon Claim
Description:
Tested whether a sensitive business flow (claiming a coupon to top up the balance) can be abused by claiming the same coupon repeatedly (replay).
Impact:
No impact: the server rejects a second claim of the same coupon (already claimed); the business flow is limited per user.
CWE:
CWE-837: Improper Enforcement of a Single, Unique Action (tested, not vulnerable)
OWASP:
API6:2023 - Unrestricted Access to Sensitive Business Flows (negative test)
Scenario:
Normal: the first coupon claim succeeds (balance +75). Exploitation: replay the same coupon -> rejected (already claimed). PASS (control holds).
Endpoint:
POST http://127.0.0.1:8888/workshop/api/shop/apply_coupon
Affected Feature:
Coupon Claim / Balance (crapi-workshop)
Remediation:
Keep the per-user coupon claim restriction (the current state is correct).
POC:
1) (Screenshot 1) NORMAL: apply_coupon TRAC075 for the first time -> succeeds, balance increases.
2) (Screenshot 2) EXPLOITATION: apply_coupon TRAC075 again -> rejected 'already claimed' (control holds).
02 — Screenshots
Screenshots (2)
Normal flow: the account's first claim of coupon TRAC075 succeeds and increases the balance.
Result (PASS): a second claim of the same coupon is rejected (already claimed). The per-user claim limit held in this test; no impact on confidentiality, integrity or availability was observed.
03 — Requests and responses
HTTP captures
Some credential values are masked in this public HTML view. This does not mean every sensitive value or linked file has been redacted.
POST /workshop/api/shop/apply_coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
{"coupon_code":"TRAC075","amount":75}HTTP/1.1 200 OK
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 57
{
"credit": 175.0,
"message": "Coupon successfully applied!"
}Normal flow: the account's first claim of coupon TRAC075 succeeds and increases the balance.
POST /workshop/api/shop/apply_coupon HTTP/1.1
Host: 127.0.0.1:8888
Authorization: Bearer [REDACTED-LAB-TOKEN]
{"coupon_code":"TRAC075","amount":75}HTTP/1.1 400 Bad Request
Server: openresty/1.27.1.2
Content-Type: application/json
Content-Length: 97
{
"message": "TRAC075 Coupon code is already claimed by you!! Please try with another coupon code"
}Result (PASS): a second claim of the same coupon is rejected (already claimed). The per-user claim limit held in this test; no impact on confidentiality, integrity or availability was observed.