Medium
Business Logic Flaws
FreshBox referral credit loop
A farmers-market subscription box. The referral check requires a distinct email, not a distinct person.
PentestingHere Academy
Official Academy lab
- Attempts
- 3
- Solves
- 0
- Published
- 25 Aug 2026
Scenario
FreshBox gives both parties credit when a referral signs up, checked only by requiring the new signup's email to differ from the referrer's.
Goal
Get your own account's referral credit up to the VIP threshold of 5000 (you start at 100). Reaching VIP unlocks the flag.