Low-level logic flaw

Platform: PortSwigger | Category: Business logic vulnerabilities | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Business logic vulnerabilities

Summary

Walkthrough of the PortSwigger Web Security Academy lab Low-level logic flaw (Business logic vulnerabilities). This lab demonstrates a business logic vulnerabilities vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Business logic vulnerabilities

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Log in as wiener.

Add the leather jacket to our cart. Now add other product also to the cart.

Add to cart sends the following request.

 http read-only • copy allowed Copy
POST /cart HTTP/2
Host: 0ae500ca036e43208a0e1dc600950057.web-security-academy.net
Cookie: session=66vBoLb5gOp0RRyz4awD36C0LmPmoyyC
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 37
Origin: https://0ae500ca036e43208a0e1dc600950057.web-security-academy.net
Referer: https://0ae500ca036e43208a0e1dc600950057.web-security-academy.net/product?productId=2
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

productId=2&redir=PRODUCT&quantity=1

The maximum quantity is 99. If we add 100 items to cart, it shows this error message.

Send the request to intruder.

• Now add payload position near the quantity value.
• Select Payload type = NUll paylaods
• Enable Continue indefinitly option.
• Start attack

Under Resource Pool, set maximum concurrent requests= 1

Now click on start attack.

After a few requests we can see that the total price has increased.

After letting it some for some more time, we see that the value has changed . The price suddenly switches to a large negative integer and starts counting up towards 0. The price has exceeded the maximum value permitted for an integer in the back-end programming language (2,147,483,647). As a result, the value has looped back around to the minimum possible value (-2,147,483,648).

Exploiting this low level logic flaw -

Send the POST request sent to /cart to intruder tab.

• Add payload position next to value of quantitiy=99.
• Set payload type as NUll payload.
• Set count to 323
• Under Reseource Pool, set Maximum concurrent requests to 1.
• Start attack.

Once the attack is finished we have the price in negative value.

Now onto stage 2 ,

• Change quantity=1 for the leather jacket.
• Send the request for 47 times.

Now the price is comparatively easy for us to bring it down to an amount within our $100 store credit.

Add another product and send it multiple times so that the negative values change to a positive values & is also within $100 dollars.

Now we can buy a huge quantity of leather jackets just for $5 !.

Place the order to solve the lab.

Key Takeaways / Lessons

• Understanding Business logic vulnerabilities detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Low-level logic flaw