Context#
Workflows pass productId, plan, or shippingMethod as hidden inputs. If the fulfillment job reads those fields without re-validating ownership and availability, an attacker can substitute a premium SKU at base price.
Theory#
Treat business parameters as hints: always re-fetch authoritative rows by ID on the server before commit.
Practice#
- Complete a purchase for a cheap item; intercept the final POST and swap identifiers for an expensive SKU in a lab catalog.
Tools#
- Burp Suite
References#
- PortSwigger Web Security Academy: Business logic vulnerabilities
- OWASP WSTG: Testing for Business Logic