Couple more blog posts on JPetStore and additional Spring MVC Autobinding vulnerabilities

On the Spring MVC topic, I added a couple more blog posts and video to the O2 developer blog:

• http://o2platform.wordpress.com/2011/07/13/viewing-jpetstore-hsqldb-database-and-couple-more-autobinding-issues/
• http://o2platform.wordpress.com/2011/07/13/writing-an-o2-ie-automation-script-for-jpetstore-account-creation/ with supporting YouTube video http://www.youtube.com/watch?v=J4Ojqzb6qsw
• http://o2platform.wordpress.com/2011/07/13/injecting-firebuglite-and-jquery-into-a-ie-automation-page-jpetstore-example/
• http://o2platform.wordpress.com/2011/07/13/creating-an-api-for-jpetstore-browser-auto/

I also noticed that using the same autobinding vulnerability, it is possible to change the quantity of the item being purchased to a negative value which has interesting implications on the current purchase and more importantly on the global (to JPetStore) 'item stock quantity' value.

I have not scripted this latest issue, but if you want looking at trying these scripts, why don't you have a go at writing it?

:)