Business Logic Vulnerability

Also Known As

TL;DR

Explanation

Business logic vulnerabilities are not caused by coding errors like injection flaws but by incorrect assumptions about how users will interact with the application — such as assuming a multi-step workflow will always be followed in order, that prices are always positive, or that quantity fields won't accept negative values. These flaws are largely invisible to automated scanners because the logic is application-specific. They require careful threat modelling, code review, and test cases that explicitly verify invariants.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Not testing negative flows: what happens if a user skips payment step, applies a coupon twice, or changes quantity after pricing?
• Trusting client-submitted prices, totals, or discount codes without server-side recalculation.
• Assuming multi-step workflows are always completed in order — attackers skip steps by crafting direct requests.
• Implementing access control at the UI layer but not re-validating it in the API handler.

Code Examples

// Trusting client-supplied price
\$item  = Product::find(\$req->product_id);
\$price = \$req->price;        // attacker sends price=0.01
Order::create(['price' => \$price, 'product_id' => \$item->id]);

// Always compute price server-side from authoritative source
\$item  = Product::findOrFail(\$req->product_id);
\$price = \$item->currentPrice(); // from DB, not the request
Order::create(['price' => \$price, 'product_id' => \$item->id]);

// Apply discounts server-side too
\$coupon = Coupon::findValid(\$req->coupon_code);
\$final  = \$coupon ? \$coupon->applyTo(\$price) : \$price;

References

• ↗ https://portswigger.net/web-security/logic-flaws
• ↗ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing

Tags

Related Terms