Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The POST /cart body accepts a signed quantity. A negative quantity for a second product offsets one jacket while a carefully tuned positive cart total still passes checkout.

Lab overview identifies the unchecked client-controlled `quantity` field in `POST /cart`.
Lab overview identifies the unchecked client-controlled `quantity` field in `POST /cart`.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates high-level logic vulnerability. The supplied accounts and endpoints are used to reproduce only the source note evidence for high-level logic vulnerability; all request changes remain inside this Academy instance.

What I observed

The POST /cart body accepts a signed quantity. A negative quantity for a second product offsets one jacket while a carefully tuned positive cart total still passes checkout.

Burp request sends an extremely large positive `quantity=10000000`, demonstrating weak quantity constraints.
Burp request sends an extremely large positive `quantity=10000000`, demonstrating weak quantity constraints.
Cart response accepts `quantity=10000000` and renders the resulting oversized line subtotal.
Cart response accepts `quantity=10000000` and renders the resulting oversized line subtotal.
The modified add-to-cart request submits a quantity of negative 10,000,002 for the offset product.
The modified add-to-cart request submits a quantity of negative 10,000,002 for the offset product.

Why it is vulnerable

Quantity validation is incomplete and the total calculation permits values outside the business domain.

Walkthrough in the authorized PortSwigger lab

  1. Capture the baseline request for high-level logic vulnerability and record the response that represents the intended lab workflow.
  2. Replay the recorded mutation that exposes high-level logic vulnerability, keeping the session and other fields unchanged.
  3. Confirm the high-level logic vulnerability signal in the response before applying the next source-documented operation.
  4. Complete the Academy objective using only the confirmed high-level logic vulnerability behavior and the supplied synthetic account or product data.
Cart displays a negative quantity and a total near negative $1,337 after multiplying price by the signed quantity.
Cart displays a negative quantity and a total near negative $1,337 after multiplying price by the signed quantity.
Checkout rejects the cart while its aggregate total remains negative.
Checkout rejects the cart while its aggregate total remains negative.
Cart combines one Lightweight l33t leather jacket with a tuned negative quantity of the offset product.
Cart combines one Lightweight l33t leather jacket with a tuned negative quantity of the offset product.
Adjusted cart total is positive but below the $100 balance while still containing one jacket.
Adjusted cart total is positive but below the $100 balance while still containing one jacket.

Verification

The final capture shows the Academy marking the high-level logic vulnerability exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Order confirmation and solved banner show checkout accepted the cart containing the negative-quantity offset.
Order confirmation and solved banner show checkout accepted the cart containing the negative-quantity offset.

Impact and defensive lesson

The evidence demonstrates the concrete risk of high-level logic vulnerability: a server-side trust decision can be bypassed through the exact input or workflow shown in this lab. For high-level logic vulnerability, the server must enforce the exact invariant violated in the captured sequence and regression-test that mutation alongside the normal path.

References