Business LogicMediumLogic flawsAbuse of functionality

Business Logic Vulnerabilities

Valid requests used in unintended ways to gain advantage - the bugs scanners miss and humans love.

Overview

Flaws in workflow assumptions - negative quantities, repeated coupon use, skipped payment steps, parameter tampering on price/role - let attackers abuse legitimate features.

How it works

Flaws in workflow assumptions - negative quantities, repeated coupon use, skipped payment steps, parameter tampering on price/role - let attackers abuse legitimate features.

Example

http

POST /cart  {"item":"x","qty":-5,"price":10}  // negative qty credits the account

Impact

Financial loss, fraud, quota/limit bypass, and integrity violations.

Detection

Model the intended workflow and probe state/sequence/value assumptions; AI-assisted reasoning highlights candidates for human review.

Prevention

Enforce invariants server-side (price, quantity, state transitions).
Re-validate every step; never trust client-computed values.
Add abuse-case tests alongside functional tests.