The Art of Business Logic — When the Checkout Got the Price ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zuksh.medium.com/the-art-of-business-logic-when-the-checkout-got-the-price-wrong-4d548971b4a3
• Blog Title: The Art of Business Logic — When the Checkout Got the Price Wrong
• Suggested Section: Pentesting Web > Bypass Payment Process > Stale Pricing State and Checkout State-Machine Abuse

🎯 Content Summary

Vulnerability overview

The post describes an e-commerce business-logic vulnerability in which checkout trusts pricing information associated with an earlier cart state after the cart has transitioned to a different state. The attacker does not directly submit a forged field such as price=1 or {"price":1}. Instead, they use the application's legitimate workflow, intercept and modify a cart-state transition, and make the backend calculate an incorrect lower amo...

🔧 Technical Details

Analyze checkout as a state machine: Record a known-good transaction from product retrieval through cart creation, discount or promotion processing, checkout, and payment. Do not limit testing to obvious fields such as price. Identify every request that changes cart state and compare the pricing data produced before and after each transition.

Abuse stale pricing state: First trigger a pricing or checkout operation so the backend creates valid derived pricing information. Then intercept a legitimate cart-state update, modify the state-controlling value, and submit it. If the backend changes the cart without invalidating pricing information associated with the previous state, trigger checkout again. A vulnerable implementation may reuse an old discount or pricing context instead of recalculating from the current authoritative product, cart, and promotion state.

Make trusted backend logic calculate the malicious result:...

🤖 Agent Actions

Updated src/pentesting-web/bypass-payment-process.md.

Added:

• Stale pricing-state and checkout state-machine abuse methodology.
• Practical transition-testing sequence.
• Cross-stage pricing invariants and stale identifier signals.
• End-to-end payment impact validation.
• Numbered citation to the supplied blog.

Validation passed:

• git diff --check
• Markdown fence/reference sanity checks
• Forbidden-source check
• Only the intended file was modified.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zuksh.medium.com/the-art-of-business-logic-when-the-checkout-got-the-price-wrong-4d548971b4a3

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Bypass Payment Process > Stale Pricing State and Checkout State-Machine Abuse".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0