312-50 Question 330
Single answer▪ Attack Application Logic FlawsDuring an authorized assessment of an e-commerce application, you create a normal user account and add a laptop priced at $1,499 to the shopping cart. Before submitting the order, you intercept the checkout request and notice a parameter named "unit_price" being sent from the client along with the product ID and quantity. You change "unit_price=1499" to "unit_price=14.99," forward the request, and the order is accepted at the lower amount without any server-side validation error. Which attack technique does this most clearly demonstrate?
- A
A price manipulation attack exploiting a business logic flaw
- B
A SQL injection attack against the order database
- C
A race condition attack during payment authorization
- D
A stored cross-site scripting attack in the checkout workflow
Show answer and explanation
Correct answer: A
Explanation
The scenario demonstrates an application logic flaw, specifically price manipulation. The core problem is that the server accepts a security-sensitive value from the client instead of deriving it from trusted server-side data such as the product catalog or session state. This is a common real-world business logic weakness in shopping carts, coupon systems, payment flows, and quantity handling. Best practice is to treat all client input as untrusted, recalculate item prices on the server, validate order state transitions, and enforce authorization and integrity checks server-side. This aligns with widely accepted secure design guidance from OWASP, especially around business logic vulnerabilities and the principle that hidden fields, client-side controls, and intercepted parameters must not be trusted for security-critical decisions.
- A. Correct.
Correct. This is a classic price manipulation scenario caused by a business logic flaw. The application is trusting a client-supplied value that should be calculated and enforced on the server side. In CEH terms, this is an attack against application logic, where the tester abuses flawed workflow or trust assumptions rather than exploiting a low-level code injection vulnerability.
- B. Incorrect.
Incorrect. SQL injection involves injecting SQL syntax into input that is later interpreted by a database query. In this scenario, there is no evidence of SQL metacharacters, query manipulation, or database error behavior. The issue is that the application accepts a tampered business value from the client.
- C. Incorrect.
Incorrect. A race condition requires exploiting timing issues, such as submitting multiple requests simultaneously to bypass inventory, coupon, or payment controls. Here, only a single modified request is needed, so the vulnerability is not dependent on concurrent execution or timing.
- D. Incorrect.
Incorrect. Stored XSS involves injecting script content that is persisted by the application and later executed in other users' browsers. Changing a numeric price parameter to reduce the purchase amount is unrelated to script injection or browser-side code execution.