Business Logic Flaw
High · Logic · CWE-840
Description
Workflow abuse (price tampering, step skipping) without classic inject payload.
Root cause
Missing server-side state/validation of process steps.
Impact
Fraud, privilege, inventory abuse.
Detection
Abuse-case testing; multi-step flows.
Mitigation
Server enforces invariants; idempotency; rate limits.
Secure coding
Threat-model checkout/approval flows.
Safe lab example
Logic-focused web labs
Practise related skills in Labs or deepen on Academy library.