Business Logic Abuse

Also Known As

TL;DR

Explanation

Business logic vulnerabilities use the application as designed but in unintended ways: negative quantities in carts (refund exploit), applying expired promo codes via replay, skipping mandatory workflow steps by manipulating URLs, race conditions on limited inventory, mass assignment of admin roles, or abusing referral systems. These are not caught by WAFs or standard security scanners because the requests are technically valid. Detection requires understanding the intended business flow and testing edge cases explicitly.

Common Misconception

Why It Matters

Common Mistakes

• Trusting client-submitted prices — always recalculate price server-side from the product database.
• No rate limiting on discount code attempts — brute-forceable codes at scale.
• Not validating workflow state transitions — user can jump from step 1 to step 5 by manipulating URLs.
• Race conditions on inventory checks — check-then-act patterns allow overselling under concurrent load.

Code Examples

// Client-controlled price — exploitable:
POST /checkout
{"items": [{"id": 42, "qty": 1, "price": 0.01}]}
// Server trusts submitted price — charges $0.01 for $99 item

// Negative quantity exploit:
{"items": [{"id": 42, "qty": -1}]}
// Cart total becomes negative — store owes the attacker

// Always recalculate server-side:
public function checkout(array $items): Money {
    $total = Money::zero('GBP');
    foreach ($items as $item) {
        // Fetch price from DB — never trust client:
        $product = $this->products->findOrFail($item['id']);
        // Validate quantity is positive integer:
        $qty = max(1, (int) $item['qty']);
        $total = $total->add($product->price->multiply($qty));
    }
    return $total;
}

References

• ↗ https://portswigger.net/web-security/logic-flaws

Tags

Related Terms