Hi everyone!!!

It all started when I have and examination online and wanted to study for it. But before paying for it I turned on burpsuite to see the data requests sent, hoping to find something good for me.

From the picture above I get the “ harga:39000 ” parameter which is the initial price of the learning I want to buy. I used the repeater on burpsuite to change it and see the response I got, and this the result.

I changed parameter “ harga:39000 ” to “ harga:1000 ” and I got “ 200 OK ”. I was very happy, and when I saw my catalog the price changed.

I contacted the website admin and reported it.

Timeline :

01 May 2022 : I reported.

01 May 2022 : Got feedback about reporting.

02 May 2022 : I got bounty from this report.

The developer gave me permission to disclose this report without mentioning them

I forgot my original goal of changing the price and buying the lessons I had changed the price for. but it’s okay for me. Maybe that’s all from me, hopefully it can be a reference for you and sorry if there are things that are not clear.