> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/overconfidence-on-the-client-side.md).
# 对客户端过于自信
### 对客户端控制的过度信任
**实验说明**
该应用程序没有正确验证客户端发送的数据。/ 可以利用购买流程中的一个逻辑缺陷来更改商品价格。/ 目标是购买一个 \*\*
提供的标识符：
* **用户**：wiener
* **密码**：peter
**行为分析**
网站上有一个购物车
在将商品添加到购物篮时，会发送一个 **POST** 包含多个参数的请求，其中包括 price。
在正常添加到购物篮时观察到的请求示例：
```bash
productId=1&redir=PRODUCT&quantity=1&price=133700
```
该 **price** 参数完全由客户端控制，并且在服务器端未被正确检查。
**利用**
通过手动更改 **price** 参数在请求中的值，例如：
```bash
productId=1&redir=PRODUCT&quantity=1&price=0
```
服务器在不进行严格验证的情况下接受该请求。
**结果**
商品被添加到购物篮，并且可以验证购买，尽管客户侧处理过价格。/ 这表明对浏览器端控制过度依赖，从而允许绕过预期的业务逻辑。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/overconfidence-on-the-client-side.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.