business-logic-vuln

A business logic vulnerability occurs when multi-step workflows lack proper validation, allowing workflow bypass. Risk arises when state transitions and check-then-act windows are exploited to bypass security controls like pricing or quotas.

To test for race conditions in multi-step workflows, map key business states and one-time actions. Running a state-transition audit reveals sequence dependencies and check-then-act windows that create exploitable logic gaps.

Detect missing cross-step authorization by mapping the ordering system's states and one-time actions. Audit the process to verify that authorization checks are properly enforced across all state transitions and multi-step sequences.

Yes, this approach works for testing coupon systems and pricing flaws. It identifies risky transitions and check-then-act windows in processes involving pricing, quotas, and approvals to surface exploitable state-desynchronization issues.

Yes, you can coordinate API access checks. The state-transition audit routes to related router skills to verify API access, uploads, and permissions, completing the path to identify cross-step authorization weaknesses.