Hard
Business Logic Flaws
SummitPass upgrade wizard step-skip
A ski-resort season-pass upgrade wizard. Step order lives only in the client; the confirm endpoint never re-checks payment.
PentestingHere Academy
Official Academy lab
- Attempts
- 1
- Solves
- 1
- Published
- 25 Aug 2026
Scenario
SummitPass's season-pass upgrade is a five-step wizard: pick tier, review price, enter payment, confirm, done. Each page decides which endpoint to call next; the server trusts that whichever endpoint gets called is the one meant to come next.
Goal
Reach the Elite tier without ever paying. The flag shows on your dashboard once your tier is Elite.