Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The cart remembers only the last coupon. Alternating SIGNUP30 and NEWCUST5 therefore reapplies both discounts until the $1,337 jacket falls below the $100 balance.

Lab overview identifies `POST /cart/coupon` as checking only the most recently applied coupon.
Lab overview identifies `POST /cart/coupon` as checking only the most recently applied coupon.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates flawed enforcement of business rules. The supplied accounts and endpoints are used to reproduce only the source note evidence for flawed enforcement of business rules; all request changes remain inside this Academy instance.

What I observed

The cart remembers only the last coupon. Alternating SIGNUP30 and NEWCUST5 therefore reapplies both discounts until the $1,337 jacket falls below the $100 balance.

Store page advertises the `NEWCUST5` coupon supplied to new customers.
Store page advertises the `NEWCUST5` coupon supplied to new customers.
Cart total reflects the first $5 reduction after applying `NEWCUST5` to the jacket.
Cart total reflects the first $5 reduction after applying `NEWCUST5` to the jacket.
Newsletter signup response reveals the second coupon code `SIGNUP30`.
Newsletter signup response reveals the second coupon code `SIGNUP30`.

Why it is vulnerable

Discount validity is checked locally per action rather than against the final order and complete promotion history.

Walkthrough in the authorized PortSwigger lab

  1. Capture the baseline request for flawed enforcement of business rules and record the response that represents the intended lab workflow.
  2. Replay the recorded mutation that exposes flawed enforcement of business rules, keeping the session and other fields unchanged.
  3. Confirm the flawed enforcement of business rules signal in the response before applying the next source-documented operation.
  4. Complete the Academy objective using only the confirmed flawed enforcement of business rules behavior and the supplied synthetic account or product data.
Cart accepts `SIGNUP30` and applies its 30 percent discount to the current order.
Cart accepts `SIGNUP30` and applies its 30 percent discount to the current order.
Cart then accepts `NEWCUST5` because it differs from the immediately preceding `SIGNUP30` code.
Cart then accepts `NEWCUST5` because it differs from the immediately preceding `SIGNUP30` code.
A second `SIGNUP30` submission is accepted after `NEWCUST5`, proving the coupon history is not checked.
A second `SIGNUP30` submission is accepted after `NEWCUST5`, proving the coupon history is not checked.
Repeated alternating `SIGNUP30` and `NEWCUST5` applications reduce the jacket total below the $100 account balance.
Repeated alternating `SIGNUP30` and `NEWCUST5` applications reduce the jacket total below the $100 account balance.

Verification

The final capture shows the Academy marking the flawed enforcement of business rules exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Order confirmation and solved banner show the discounted Lightweight l33t leather jacket was purchased.
Order confirmation and solved banner show the discounted Lightweight l33t leather jacket was purchased.

Impact and defensive lesson

The evidence demonstrates the concrete risk of flawed enforcement of business rules: a server-side trust decision can be bypassed through the exact input or workflow shown in this lab. For flawed enforcement of business rules, the server must enforce the exact invariant violated in the captured sequence and regression-test that mutation alongside the normal path.

References