Business Logic Flaw (Negative Quantity Abuse)

Business logic flaws aren't injection or memory-corruption bugs — every individual line of code runs correctly. The vulnerability is a gap in the assumed rules of the workflow itself, like a quantity field that was only ever expected to be positive, which the application never actually enforces.

These bugs are invisible to automated scanners looking for injection signatures — they require actually understanding what the workflow is supposed to guarantee and checking whether the code guarantees it

A negative quantity in a 'price × quantity' calculation flips a charge into a credit — perfectly correct arithmetic, applied to an input nobody validated as being required to be positive

The general pattern is: find a value in a multi-step workflow that later steps implicitly assume is within some range, and check whether any step actually enforces that range

Fixing these requires explicit, deliberate bounds/state validation at each step of a workflow — there's no generic library or WAF rule that catches 'this number should have been positive'

Want this flow explained in detail as it plays?

POST/api/cart/add-item

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Quick-Insert Payloads

Defense in depth

Explicitly validate that quantity (and any other multiplied/summed business value) is within an expected positive range at the point of use, not just at initial input — don't assume a value stays valid across a multi-step workflow
Re-validate business rules (coupon eligibility, minimum order value, inventory availability) against the actual final state at the moment of charge, not against an earlier intermediate state that could have changed since
Write tests specifically for 'what if this number is negative / zero / far larger than expected' for every quantity, price, and count field in a workflow — these are the test cases a functional happy-path suite tends to skip entirely

Vulnerable vs. Fixed

app.post("/api/cart/add-item", async (req, res) => {
  const { itemId, quantity } = req.body; // no bounds check — quantity can be zero, negative, or absurdly large
  const price = await getPrice(itemId);
  await cart.addLine(req.session.cartId, { itemId, quantity, lineTotal: price * quantity });
  res.json({ success: true });
});