The app allows us to select a number between 3 and 13 from the number input form. Let's also try typing numbers outside that interval directly into the field.
Exploitation
We could intercept and modify the request on Burp:
Or alternatively, use devtools to modify the client-side restrictions directly:
And goal achieved! We could bypass the client-side restrictions.
