312-50 Question 331
Single answer▪ Attack Application Logic FlawsDuring an authorized assessment of an online retail application, you notice the checkout workflow applies a discount code in the client session before payment is finalized. By intercepting requests with a proxy, you observe that the server accepts a POST request to /applyCoupon with a JSON body containing {"coupon":"WELCOME20"}, then later trusts a client-supplied field in the final /checkout request showing the discounted total. You successfully modify the discounted total from $80 to $8 and the order is accepted without any server-side recalculation. Which finding best describes this issue?
- A
A server-side business logic flaw caused by trusting client-controlled pricing data during checkout
- B
A stored cross-site scripting vulnerability because user input changes the order value
- C
A SQL injection vulnerability because the coupon field is submitted in JSON format
- D
A race condition because the discount is applied before payment is submitted
Show answer and explanation
Correct answer: A
Explanation
This scenario tests recognition of an application logic flaw, specifically a server-side trust violation in a purchasing workflow. In real assessments, ethical hackers often look for places where business-critical values such as price, quantity, role, discount, shipping cost, or transaction status are calculated or stored on the client and then trusted by the server. According to secure development best practices, including OWASP guidance on business logic and input validation, the server must treat all client input as untrusted and recompute sensitive values from authoritative server-side data before completing a transaction. The core problem is not the coupon itself, but that the final amount can be manipulated and accepted. This can lead to fraud, revenue loss, and abuse of checkout processes.
- A. Correct.
Correct. This is a classic application logic or business logic flaw: the server is relying on client-controlled values for a security-sensitive action, namely pricing and order total calculation. In a secure design, the server should validate the coupon, recompute the total from authoritative product and discount data, and ignore any manipulated client-side price fields. Attackers commonly exploit this type of flaw by tampering with hidden fields, JSON parameters, or API requests.
- B. Incorrect.
Incorrect. Stored XSS involves malicious script being stored by the application and later executed in other users' browsers. In this scenario, the issue is price manipulation in the checkout flow, not script injection or browser-side code execution. Someone might choose this option because user-controlled input is involved, but the impact and mechanism do not match XSS.
- C. Incorrect.
Incorrect. SQL injection occurs when untrusted input is unsafely incorporated into SQL queries, allowing query manipulation. The fact that the coupon is submitted in JSON does not imply SQL injection. JSON is only a transport format. The scenario specifically describes the server accepting a tampered total rather than improper query construction.
- D. Incorrect.
Incorrect. A race condition involves exploiting timing issues between concurrent operations, such as redeeming the same coupon multiple times before state is updated. Here, the vulnerability is not about timing or parallel requests; it is that the application accepts a client-supplied discounted total without server-side verification.