Hello everyone 👋

While testing an e-commerce platform, I discovered an interesting Business Logic vulnerability in the shopping cart functionality that allowed price manipulation through negative quantity values.

The issue existed because the application failed to properly validate product quantities on the server side.

While testing an e-commerce platform, I discovered a Business Logic vulnerability in the shopping cart functionality.

By manipulating the product quantity parameter to a negative value (-1), the application allowed the cart total to become negative instead of validating the input properly.

This led to a price manipulation issue where adding additional products with positive quantities reduced the final payable amount dramatically.

Impact

I was able to:

• Add an expensive product worth 630

• Set its quantity to -1

• Add 53 other products priced at 11.91
• Complete the purchase for only 1.23

. I can complete order

Remediation

• Reject negative and zero quantities server-side
• Validate cart operations before checkout
• Implement integrity checks on total calculations
• Recalculate prices securely on the backend

Business logic vulnerabilities are often overlooked because no "classic exploit" is involved — yet their impact can be critical.