John visits an online shop that stores the IDs and prices of the items to buy in a cookie. After selecting the items that he wants to buy, the attacker changes the price of the item to 1. Original coo

Cross-site scripting (XSS) involves injecting malicious client-side scripts into web pages that execute in other users' browsers; it does not involve modifying cookie price fields to alter transaction totals.

Computer-based social engineering manipulates people into revealing information or taking actions through deception via technology; John is directly manipulating HTTP data, not deceiving a person.

A man-in-the-middle attack requires the attacker to intercept and alter communications between two other parties in transit; here John is modifying his own browser's cookies, not intercepting another party's traffic.

Cookie poisoning occurs when an attacker tampers with the values stored in an HTTP cookie before the browser sends them back to the server. In this scenario, John directly edited the ItemPrice fields in the cookie from their legitimate values (900 and 200) to 1, and the server accepted these attacker-controlled values when computing the purchase total. The vulnerability exists because the application stores mutable, trust-sensitive data like prices in a client-controlled location instead of referencing them server-side from a trusted database.