What is Business-logic vulnerability?
A flaw in the rules of how an application is supposed to work — reusing a one-time coupon, tampering a price — where every request is valid but the outcome breaks a rule.
Business-logic vulnerability: A flaw in the rules of how an application is supposed to work — reusing a one-time coupon, tampering a price — where every request is valid but the outcome breaks a rule.
In plain language
Business-logic bugs are unique to your application because they live in your rules, not in a library. Reuse a single-use discount, skip a payment step, approve your own request, buy at a client-set price — the HTTP is perfectly well-formed; the logic is what fails.
There is no signature for a rule only you defined, so scanners cannot see these. SuperPentest hypothesises against the rule, abuses the workflow to test it, and reproduces the abuse — see the business-logic research.
A concrete example
A checkout applies WELCOME10 once per account — but the server trusts a coupon id the client sends, so submitting the same code with two different ids stacks the discount to 20%, 30%, more. Every request is valid HTTP; the rule “one use per account” lives only in intent. SuperPentest abuses the workflow to test the rule, then reproduces the stacked discount as proof.
Related
Business-logic testing → · Business-logic research →
Want this tested on your app? Book a demo or read how findings are verified.