There is a Business logic vulnerability that can change the payment price.

[JrDw0]

First we have selected seven items. The price is ¥6*7=¥42.

Then we can get the request package.

We changed the value of the parameter item_totals to 0.

So we can get free products like this.