High-level logic vulnerability

PortSwigger

Lab Description

This lab doesn’t adequately validate user input. You can exploit a logic flaw in its purchasing workflow to buy items for an unintended price. To solve the lab, buy a “Lightweight l33t leather jacket”.

• Your credentials: wiener:peter

---

---

Step 1: Understanding the Vulnerability

The logic flaw:

• The application accepts negative quantities for items in the cart
• It doesn’t validate that quantity cannot be negative
• It doesn’t check that you can’t remove more items than you have

The attack:

1. Add a cheap item to cart
2. Modify its quantity to a negative number
3. This reduces the total cart price (negative amount)
4. Add the expensive jacket to cart
5. The negative amount offsets the jacket price
6. Purchase the jacket for less than your credit

---

Step 2: Reconnaissance

Step 2.1: Log In

1. Log in with wiener:peter
2. Check your store credit (e.g., $100)

Step 2.2: Find a Cheap Item

Look for the cheapest item in the shop (e.g., a $5 item or similar).

---

Step 3: Testing Quantity Manipulation

Step 3.1: Add Cheap Item to Cart

1. Add the cheap item to your cart
2. Capture the POST /cart request in Burp

The request:

POST /cart HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Content-Type: application/x-www-form-urlencoded

productId=2&redir=PRODUCT&quantity=1&price=5

Step 3.2: Change to Negative Quantity

Modify the quantity parameter:

Original:

quantity=1

Modified:

quantity=-2

Step 3.3: Send the Request

Forward the modified request.

Step 3.4: Check the Cart

Refresh the cart page.

Expected result:

• The cheap item now shows quantity -2
• The total price is negative (e.g., -$10)

Negative quantities are accepted!

---

Step 4: Exploiting the Flaw

Step 4.1: Add the Jacket

1. Add the “Lightweight l33t leather jacket” to cart
2. Cart now shows:
   • Jacket: +$1337
   • Cheap item: -$10
   • Total: $1327

Still above $100 credit.

Step 4.2: Increase Negative Quantity

Go back to the cheap item and modify its quantity to a larger negative number:

Quantity	Impact
-2	-$10
-10	-$50
-100	-$500
-250	-$1250

Calculate needed:

Jacket price: $1337
Store credit: $100
Need total ≤ $100

Target total: $100
Needed discount: $1337 - $100 = $1237

Cheap item price: $91.49
Quantity needed: -$1237 / $91.49 = -13.52 ≈ -14

tep 4.3: Apply the Calculation

Set the cheap item quantity to -15:

quantity=-15

Result:

• Cheap item: -15 × $91.49=-$1,372.35
• Jacket: +$1337
• Total: $35.35

Total is now less than $100 credit!

---

Step 5: Completing the Purchase

Step 5.1: Checkout

1. Go to checkout
2. Verify total is within your credit
3. Complete the order

Step 5.2: Successful Purchase

The jacket is purchased!

---

Step 6: Lab Solved

Success message displayed:

---

---