The $5,000 Business Logic Bug Everyone Walked Past

This is my favorite kind of bug because it needs zero "hacking" — no payloads, no injection. Just noticing that the app's LOGIC doesn't make sense and poking it. Let me tell you about a business logic bug that a dozen scanners walked right past, because scanners can't think.

The Target

A subscription SaaS with tiered plans — Free, Pro, Enterprise. Pro unlocked a bunch of premium features. The upgrade flow was the obvious money-maker, so that's where I camped.

I didn't attack it. I just… used it. Slowly. Like a confused customer. And that's when the "wow" moment hit.

The "Wow" Moment

When you upgraded, the app sent a request that included your target plan:

{ "plan": "pro", "billing_cycle": "monthly" }

And my brain went: "what if I just… write enterprise? Or something that isn't a real plan? Or set the price myself?"

So in Burp I tried a few things:

• Changed "pro" to "enterprise" → got Enterprise features on a Pro payment 😳
• Then went further: started the upgrade, intercepted, and changed the amount field the app trusted from the client side

The app trusted values it should NEVER have trusted from the user. That's the whole bug.

Why Scanners Miss This

A scanner sees a normal-looking request with a normal-looking response. No error. No injection. Nothing "technically" wrong. It has no idea that a Free user getting Enterprise features for $0 is a catastrophe, because it doesn't understand what the BUSINESS wanted. Only a human who thinks "wait, should this be allowed?" catches it.

What This Taught Me

• Use the app like a real, slightly-mischievous customer. The "huh" moments are the bugs.
• Watch every value the app trusts from you — plan, price, quantity, role, user ID.
• Money flows = logic bugs. Upgrades, refunds, credits, coupons — camp there.
• Less competition. Everyone's spraying XSS payloads. Almost nobody's calmly abusing the upgrade flow.