Business Logic Flaws

What Is Broken and Why

Business logic flaws occur when an application's security controls are implemented only on the client side, or when developers assume users will always follow the intended workflow. Unlike injection attacks, these vulnerabilities use the application's own features correctly from a technical standpoint but in unintended sequences or with unexpected values. They are particularly dangerous because automated scanners rarely detect them — they require understanding the application's intended purpose. Common manifestations include price/quantity manipulation, workflow step bypass, coupon reuse, race conditions in financial operations, and privilege escalation via hidden or predictable parameters.

Key Signals

• Hidden form fields containing prices, discount amounts, user roles, or IDs
• Multi-step purchase/checkout workflows where steps can be skipped via direct URL navigation
• Coupon or discount codes accepted multiple times
• Pricing or quantity fields not validated server-side (only validated in JavaScript)
• Parameters incrementing predictably (orderId=1001, 1002…) suggesting enumerable resources
• Time-sensitive operations (balance checks, reservation holds) that can be exploited between check and action
• Admin or privilege flags passed in HTTP parameters
• Audit log endpoints with insufficient access controls