Question 1

What is business logic abuse?

Accepted Answer

Business logic abuse exploits flaws in an application's rules rather than a technical bug like injection. The requests are perfectly valid HTTP; the problem is that the workflow trusts client-supplied values — quantity, price, coupons — or fails to enforce sane limits, so an attacker gets an outcome the business never intended, such as a negative order total.

Question 2

How does a negative total happen at checkout?

Accepted Answer

If the server multiplies a client-supplied quantity by a price without requiring the quantity to be a positive integer, a value like -3 produces a negative line total — effectively crediting the attacker. Stacking multiple percentage coupons the server never caps can drive the total below zero the same way.

Question 3

How do I prevent business logic abuse?

Accepted Answer

Treat every client value as untrusted: look prices up server-side from the catalog, require quantities to be positive integers within limits, floor the total at zero, and enforce coupon rules (eligibility, expiry, one-per-order or explicit stacking limits) against the database rather than the incoming cart.

Business Logic Abuse

Challenges

Frequently Asked Questions