Business Logic Flaws

What it is#

A business logic flaw isn't a missing input filter or a missing escape function; it's a step in the application's own designed workflow that an attacker can skip, repeat, or reorder in a way the design never accounted for.

How it works#

$price = (float) $_POST['price']; // trusts a value the client sent
$order = createOrder($item, $price);

Nothing here is invalid input in the traditional sense: $_POST['price'] is a perfectly well-formed number, it's just one the server should never have trusted, because the client controls it entirely.

Real-world impact#

Financial loss, such as arbitrary pricing or discount stacking, and workflow bypass, such as skipping a payment or approval step that the UI merely hides rather than one the server actually enforces.

How to prevent it#

$price = $catalog->priceFor($item); // derived server-side, never trusted from the client

Recompute anything that determines money, permission, or state transitions from server-side data at the moment it's needed, and re-validate every step of a multi-step workflow server-side, not only the final one, since a client can call any endpoint directly regardless of what the UI shows.