Hotel Promotions Web Application Test Found Free Booking Weakness
What we tested
Wolfcore carried out a web application test of a hotel company’s promotional environment. That is the part of the booking system that handles promotions and bookings. We tested the web application itself, looking for ways it could be misused.
What we found
Weaknesses in the promotional environment. The weaknesses we found let a user make bookings for free.
We have not described how, and we will not. The point for the business is the outcome: the promotional environment did not stop a booking being made without paying.
Outcome
Wolfcore reported the findings with clear fix steps. A retest was offered.
Why testing promotions and bookings matters
This section is general background, not a finding from the engagement.
Promotions and offers change how a booking is priced, so they deserve the same attention as the payment page. A web application test checks those features as an attacker would, rather than only checking that they work as designed for a normal customer.
Test your own booking and promotions systems
If your business takes bookings or orders online, or runs promotions and offers, a web application test is a sensible place to start. See our wider penetration testing service, or book a conversation.
Ruben Selby, founder and penetration tester at Wolfcore