Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by rulebreker - 29.07.2026
Last edited by flyspray - 29.07.2026

Description

A Price Manipulation vulnerability exists in the domain purchase payment flow. By intercepting the payment request before it is sent to PayPal, an attacker can modify the payment amount from the legitimate purchase price to an arbitrary lower value (e.g., 1). PayPal then processes the modified amount, and after the payment is completed, the application accepts the transaction and displays a successful payment confirmation ("Thank You for Payment").

This indicates that the application trusts the client-supplied payment amount instead of validating the payment against the server-side order value before confirming the purchase.

CVSS v3.1 → Base Score: 8.8 (High)

Steps to Reproduce

1- Log in to a valid user account.
2- Navigate to the Domain section.
3- Click Add Domain.
4- Enter the details of a non-existing domain.
5- Continue until the final payment page where PayPal is selected.
6- Intercept the payment request using Burp Suite.
7- Modify the payment amount parameter from the original value to 1.
8- Forward the modified request.
9- Observe that PayPal requests payment of only 1.
10- Complete the payment.
11- Return to the application.
12- Observe that the application displays "Thank You for Payment", accepting the manipulated payment as successful.

Actual Behavior

The application accepts a client-modified payment amount and successfully completes the purchase workflow after receiving the PayPal payment notification, despite the payment being significantly lower than the actual order value.
Expected Behavior

The server must independently verify:

The original order amount.
The amount received from PayPal.
The payment status.
The associated order ID.

If any mismatch exists, the payment must be rejected, the order should not be fulfilled, and the user should be informed that payment verification failed.

Impact

Successful exploitation could allow an attacker to:

Purchase domains for significantly less than their actual price.
Pay only a minimal amount while receiving full services.
Manipulate payment values for financial gain.
Bypass intended pricing controls.
Cause revenue loss through fraudulent transactions.

Business Impact

This vulnerability can have serious financial and operational consequences, including:

1- Direct revenue loss from underpaid purchases.
2- Abuse of the domain registration process.
3- Fraudulent acquisition of paid services.
4- Loss of trust in the payment platform.
5- Increased chargebacks and payment disputes.
6- Potential compliance and accounting issues due to inconsistent transaction records.
7- Reputational damage if exploited at scale

Remediation

Implement strict server-side payment validation:

1- Never trust the payment amount received from the client.
2- Generate the payment amount exclusively on the server.
3- Validate the PayPal transaction using PayPal's API before completing the order.
4- Reject transactions where the paid amount does not exactly match the server-side order value.
5- Bind each payment to a unique server-generated order.
6- Prevent client-side modification of pricing information.

Conclusion

The application is vulnerable to server-side price manipulation, allowing authenticated users to alter the payment amount before it reaches PayPal. Because the backend accepts the manipulated payment without validating it against the original order value, attackers may obtain paid services while paying only a fraction of the legitimate price. Proper server-side verification of payment amounts and transaction details is essential to prevent financial fraud and protect the integrity of the payment system.

Thanks