312-50 Question 332
Single answer▪ Attack Application Logic FlawsDuring an authorized assessment of an e-commerce application, you observe that discount codes are validated on the client side and then submitted to the server in a JSON request containing the fields "couponCode", "discountPercent", and "finalPrice". By intercepting the request, you change "discountPercent" from 10 to 90 and lower "finalPrice" accordingly. The server accepts the order and completes checkout without revalidating the discount against server-side business rules. Which issue best describes this weakness?
- A
A business logic flaw caused by trusting client-supplied pricing and discount values
- B
A SQL injection vulnerability caused by unsanitized coupon input
- C
A cross-site scripting vulnerability caused by reflective handling of coupon codes
- D
A race condition caused by submitting multiple checkout requests simultaneously
Show answer and explanation
Correct answer: A
Explanation
The best answer is the business logic flaw caused by trusting client-supplied pricing and discount values. In secure application design, the server must treat all client input as untrusted and enforce pricing, discount eligibility, and final totals on the server side. This scenario is a practical example of parameter tampering leading to abuse of workflow or transaction logic. It is commonly seen in shopping carts, loyalty programs, coupon redemption, and payment flows. Industry best practices such as the OWASP Web Security Testing Guide and OWASP Top 10 guidance on broken access control and insecure design emphasize that sensitive business decisions must not rely on client-side controls. A secure implementation would ignore client-provided finalPrice and recompute discount eligibility and order totals server-side before completing checkout.
- A. Correct.
Correct. This is a classic application logic or business logic flaw. The application improperly trusts client-controlled fields such as discountPercent and finalPrice instead of recalculating them on the server. In real-world testing, this is commonly identified as parameter tampering against pricing or workflow logic. The core problem is not input syntax but failed enforcement of server-side business rules.
- B. Incorrect.
Incorrect. SQL injection involves manipulating input so it changes the structure or behavior of a backend SQL query. In this scenario, the tester is altering business values in a request and the server accepts those values as authoritative. There is no evidence of database query manipulation or injection behavior.
- C. Incorrect.
Incorrect. Cross-site scripting requires untrusted input to be returned to a browser and executed as script in a victim's context. Here, the impact is unauthorized discount manipulation during checkout, which indicates broken business logic rather than script execution in the browser.
- D. Incorrect.
Incorrect. A race condition would involve exploiting timing issues, such as sending concurrent requests to redeem the same coupon multiple times before state is updated. In this case, only a single modified request is needed because the server fails to validate the pricing logic at all.