Description

Business logic weaknesses arise from flaws in the design and implementation of an application. They allow an attacker to manipulate legitimate functions to trigger unwanted behavior, for example by altering prices or balances, skipping payment or validation steps, bypassing frontend-only limits, or repeating single-use actions.

Impact

- Obtain money, products, or services for free, at a lower price, or beyond allowed limits. - Alter business data such as balances, points, rates, or user information. - Perform transactions or open accounts on behalf of other users. - Bypass business controls such as transaction limits, identity verification, or user blocks. - Lock or saturate resources, such as seats, emails, or backend processes, so legitimate users cannot use them. - Abuse promotional programs such as coupons, referrals, bonuses, or incentives. - Gain access to sensitive data and functions.

Recommendation

Ensure that the functionalities provided are clear in both design and operation and that the flows fulfill their specific function.

Threat

Authenticated attacker with access to the service from the Internet.

Expected Remediation Time

⏱️ 2400 minutes.

Requirements

Fixes

No fixes are currently available.