Cheesy Does It
Daily · 8 writeupsA recurring daily challenge — each entry covers a different vulnerability. Listed oldest to newest.
BugForge - Daily - Cheesy Does It (Dec 29, 2025)
This vulnerability is an Insecure Direct Object Reference (IDOR) caused by missing server-side authorization checks when accessing order data. The…
BugForge - Daily - Cheesy Does It (Jan 5, 2026)
The login functionality is vulnerable to SQL Injection, allowing attackers to bypass authentication and gain unauthorized access to admin accounts. By…
BugForge - Daily - Cheesy Does It (Jan 19, 2026)
This vulnerability is a business logic flaw in the checkout process where the backend accepts client-supplied discount data without enforcing strict validation…
BugForge - Daily - Cheesy Does It (Jan 26, 2026)
A business logic flaw in the refund endpoint allows arbitrary refund amounts without validation against actual order values. The API endpoint and payload…
BugForge - Daily - Cheesy Does It (Feb 2, 2026)
A business logic flaw in the tip functionality of the Cheesy Does It pizza ordering application allows users to submit negative tip percentages during the…
BugForge - Daily - Cheesy Does It (Jul 5, 2026)
The Cheesy Does It password reset accepts a null OTP, skipping verification to hand back the admin reset token and enabling a full account takeover.
BugForge - Daily - Cheesy Does It (Jul 13, 2026)
The Cheesy Does It reorder endpoint re-applies a client-supplied coupon without re-checking its one-per-customer limit, letting the single-use FOUNDERS20 promo be redeemed again and again to disclose the flag.
BugForge - Daily - Cheesy Does It (Jul 15, 2026)
Cheesy Does It checks username uniqueness on the raw string but NFKC-normalizes the username when authorizing admin actions. Registering a fullwidth homoglyph of admin (ａdmin) creates a distinct account that the app treats as the administrator, leaking the flag from the admin dashboard.