Summary

There are several hidden input fields in the page where tickets for the Alhambra can be purchased which, when manipulated in a specific way, can change the price that the system thinks a ticket is worth, thus allowing to lower its price.

Reproduction steps

1. Open Chrome.
2. Access https://compratickets.alhambra-patronato.es/reservarEntradas.aspx/?opc=2&gid=2&lg=es&ca=1.
3. Open the Developer Tools and go to the Elements tab.
4. While having the focus in the Developer Tools, press ⌃+f (or ⌘+f in macOS) and enter input[name$="$ctl00$hdComision"] in the search bar. This will highlight the following element:

<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdComision" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdComision" value="0,85">

5. Change the value from 0,85 to 0.
6. Now do the same with each one of the 4 input fields which are next to the one we changed before, changing its values to the following:
   • Input with name [...]ctl00$hdIVAComision: 0
   • Input with name [...]ctl00$hdPrecioSinIVA: 0,01
   • Input with name [...]ctl00$hdPrecioConIVA: 0,01
   • Input with name [...]ctl00$hdPrecioConComision: 0,01

This will leave all the hidden input elements like this:

<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdComision" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdComision" value="0">
<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdIVAComision" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdIVAComision" value="0">
<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdPrecioSinIVA" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdPrecioSinIVA" value="0,01">
<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdPrecioConIVA" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdPrecioConIVA" value="0,01">
<input type="hidden" name="ctl00$ContentMaster1$ucReservarEntradasAlhambra1$rptGruposEntradas$ctl00$rptEntradas$ctl00$hdPrecioConComision" id="ctl00_ContentMaster1_ucReservarEntradasAlhambra1_rptGruposEntradas_ctl00_rptEntradas_ctl00_hdPrecioConComision" value="0,01">

7. Now click the + button next to Entrada Alhambra General in order to add one ticket.
8. You'll immediately see that the final price is now 0,01 € instead of the 14,85 € that costs the ticket.

9. Click the Paso 2 button and follow the remaining steps in order to purchase the ticket (select an available day to visit the Alhambra, a valid hour for the palacios nazaríes, enter your personal details, and finally click the Finalizar compra button).
10. After doing this, you'll be redirected to https://sis.redsys.es/sis/realizarPago in order to enter the credit card details and pay 0,01 €.

11. After entering the credit card details, a 0,01 € transaction is made and the ticket is sent to the email entered in the form.

Attack vector

This vulnerability can be used obviously to get tickets for the Alhambra for 0,01 €.

Suggested resolution

It seems like the system saves the ticket price in the HTML structure of the site, and when a ticket is added, this value is sent back to the server and is used to compute the total price. In order to fix this vulnerability issue, the server-side code should be rewritten in order to not trust the ticket price saved in the HTML code, but get it directly from the database where the prices are set (or wherever it is saved), but never trusting user input.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.