# An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss

Semrush marketplace bulk purchase API accepted negative article quantities, letting an attacker reduce total cart price to near zero.

- Payout: hidden
- Severity: high
- Program: Semrush
- Found by: yashrs
- Disclosed: 2020-04-02
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/771694
- Library page: https://bugbountylibrary.com/r/h1%3A771694
- Tags: area:web domain:web impact:funds-loss impact:integrity kind:bounty platform:hackerone sev:high tech:rest vuln:accounting-error vuln:business-logic

**Target:** Marketplace bulk purchase API endpoint /marketplace/api/purchases/bulk
**Root cause:** The bulk purchase endpoint trusted client-supplied per-item quantities without validating them as positive, so negative quantities subtracted from the cart total.
**Steps:**
1. Go to https://www.semrush.com/marketplace/offers/ and click 500 Words ($40) Order Now.
2. Select two articles and intercept the POST /marketplace/api/purchases/bulk request.
3. Original body `{"items":{"article_500":1,"article_1000":1}}` totals $110.
4. Change body to `{"items":{"article_500":4,"article_1000":-2}}`.
5. Total becomes 4*$40 - 2*$70 = $20; checkout charges the reduced amount.
**How found:** Researcher inspected the bulk purchase request body and hypothesized that quantity values were used directly in price arithmetic without sign validation.
**Exploitation:** Attacker manipulates the JSON items map to add a high-priced item with a negative quantity, offsetting the cost of desired items and paying far less at checkout.
**Insight:** On e-commerce/marketplace checkout APIs, fuzz per-line quantity and price fields with negative and zero values; totals computed client-side or naively server-side often accept them.