T09 · Insecure Skill Coding Practices
Error
- Location
- references/wechat-pay-guide.md:220
- Finding
- Client-Controlled Payment Amount Enables Order Price Manipulation<![CDATA[ ## Vulnerability Details **File Location**: `references/wechat-pay-guide.md`, lines 220–229 **Vulnerability Type**: Client-side price manipulation **Risk Level**: High ### Vulnerable Code ```javascript const res = await wx.request({ url: 'https://yourdomain.com/api/orders', method: 'POST', data: { productId: this.data.productId, amount: this.data.amount } }) return res.data ``` ### Technical Analysis The order request sends both the product identifier and payment amount from the mini-program client. Client-side state such as `this.data.amount` cannot be trusted because users can modify the application, intercept requests, or directly invoke the API with an arbitrary payload. The guide does not instruct the server to disregard the submitted amount and retrieve the authoritative price from a trusted product or membership-plan record. If the backend uses this value when creating the local order or WeChat transaction, the user controls the amount charged. ### Attack Path 1. An attacker selects a legitimate paid product. 2. The attacker intercepts or reproduces the request to `/api/orders`. 3. The attacker retains the legitimate `productId` but replaces `amount` with a reduced value, such as one cent. 4. The backend creates an underpriced order using the client-provided amount. 5. The attacker completes the valid WeChat payment for the reduced amount. 6. The application treats the product order as paid and grants the associated goods or service. ### Impact Assessment Successful exploitation can allow an unauthenticated or ordinary authenticated customer to purchase products or memberships below their configured price. The affected scope includes payment integrity, order revenue, product fulfillment, membership access, and financial reconciliation. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not accept an authoritative price or payment amount from the client. - Require the client to submit only a product or plan identifier and any permitted quantity. - On the server, retrieve the active product record and calculate the amount from trusted database values. - Persist the expected amount and currency in the order before creating the WeChat transaction. - Reject inactive products, invalid quantities, and prices outside supported integer-cent ranges. - During the payment callback, compare the paid amount and currency against the persisted order. - Add integration tests that submit modified, negative, zero, excessive, and stale prices. ]]>