Cart value exploit using 'tamper data' firefox plug-in

[schmezo]

I received information from a client who was helpful enough to make this screen cast of the problem:

http://www.youtube.com/watch?v=TqZLcZTcWA&feature=youtu.be



He claims that with the "tamper data" plugin for FF, you can change the value of the order say from $5, to $0 and submit the order.



He states in passing the value from my site to the cart, the value can be changed.



How can I fix this?

[E-junkie_Guru]

We are aware of these types of exploits, so that is why we perform a price check after checkout before we actually process the order (issue links/codes, log the transaction details, send emails).



If the amount paid for an item does not meet or exceed the item's current price in Seller Admin, our system will refuse to process the order, and instead we email the order details to you in a Suspected Fraud notification, so you can decide how to handle the situation.



A mismatch could also occur if you happen to edit the item price after a buyer took their order to checkout but before they completed payment, so the Suspected Fraud notification gives you a chance to realize if that happened and fulfill the order manually -- e.g., by shipping a tangible item or using "Send free download link/code" for digital products.