> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/business-logic-flaw/cheesy-does-it-1.md).

# Cheesy Does It

Level: Easy\
Points: 10\
Type: Daily Challenge

Lab Interface

<figure><img src="/files/JxgJ8ehWeiPN3Adbwehs" alt=""><figcaption></figcaption></figure>

Discount code `PIZZA-10` is provided.

During order checkout, we have option to add discount code.

<figure><img src="/files/6pKQ8WO0OlbKqAFhwTA6" alt=""><figcaption></figcaption></figure>

Its respective request is

<figure><img src="/files/Z8VLYSPULQn2tb80NzWN" alt=""><figcaption></figcaption></figure>

Here, we can edit the discount parameter from

```
"discount":"PIZZA-10"
```

to

```
"discount":["PIZZA-10","PIZZA-10","PIZZA-10","PIZZA-10"]
```

and the system applies the **same coupon multiple times**.

<figure><img src="/files/IGDQssKrTl50TpeNjeB2" alt=""><figcaption></figcaption></figure>

forward the request and we will get our flag.

<figure><img src="/files/kfo1UDmEXrwGopSDFN5e" alt=""><figcaption></figcaption></figure>