Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

Repeating quantity=99 additions drives the cent-denominated cart total past signed 32-bit INT_MAX. The wrapped negative total can then be tuned below the $100 balance.

Lab overview identifies 32-bit signed integer overflow in accumulated cart prices.
Lab overview identifies 32-bit signed integer overflow in accumulated cart prices.

Lab objective/setup

This intentionally vulnerable Academy exercise isolates low-level logic flaw. The supplied accounts and endpoints are used to reproduce only the source note evidence for low-level logic flaw; all request changes remain inside this Academy instance.

What I observed

Repeating quantity=99 additions drives the cent-denominated cart total past signed 32-bit INT_MAX. The wrapped negative total can then be tuned below the $100 balance.

Normal add-to-cart flow establishes the jacket product and baseline quantity behavior.
Normal add-to-cart flow establishes the jacket product and baseline quantity behavior.
Request decreases the same product with a negative quantity, which the cart accepts for an existing line.
Request decreases the same product with a negative quantity, which the cart accepts for an existing line.
Request attempts a negative quantity for a different product to test cross-product offsetting.
Request attempts a negative quantity for a different product to test cross-product offsetting.
Cart response rejects the negative quantity for the different product, closing the simple offset path.
Cart response rejects the negative quantity for the different product, closing the simple offset path.

Why it is vulnerable

Arithmetic performed in a bounded numeric type can overflow unless ranges and final totals are checked safely.

Walkthrough in the authorized PortSwigger lab

  1. Capture the baseline request for low-level logic flaw and record the response that represents the intended lab workflow.
  2. Replay the recorded mutation that exposes low-level logic flaw, keeping the session and other fields unchanged.
  3. Confirm the low-level logic flaw signal in the response before applying the next source-documented operation.
  4. Complete the Academy objective using only the confirmed low-level logic flaw behavior and the supplied synthetic account or product data.
Burp request attempts `quantity=1000` in one add-to-cart operation.
Burp request attempts `quantity=1000` in one add-to-cart operation.
Application response enforces a per-request maximum quantity of 99.
Application response enforces a per-request maximum quantity of 99.
Intruder configuration repeats `quantity=99` additions 324 times for the selected product.
Intruder configuration repeats `quantity=99` additions 324 times for the selected product.
Intruder results show the repeated add-to-cart requests used to accumulate 30,492 units.
Intruder results show the repeated add-to-cart requests used to accumulate 30,492 units.
Cart total wraps past signed `INT_MAX` and is rendered as a negative monetary amount.
Cart total wraps past signed `INT_MAX` and is rendered as a negative monetary amount.
Quantity adjustments bring the wrapped total to approximately negative $1,221.96.
Quantity adjustments bring the wrapped total to approximately negative $1,221.96.
Cart contains the jacket plus balancing products with a final positive total no greater than $100.
Cart contains the jacket plus balancing products with a final positive total no greater than $100.

Verification

The final capture shows the Academy marking the low-level logic flaw exercise as solved after the documented request sequence. No testing was performed outside the isolated lab.

Order confirmation and Academy solved banner show checkout succeeded after the integer-wrapped total was tuned.
Order confirmation and Academy solved banner show checkout succeeded after the integer-wrapped total was tuned.

Impact and defensive lesson

The evidence demonstrates the concrete risk of low-level logic flaw: a server-side trust decision can be bypassed through the exact input or workflow shown in this lab. For low-level logic flaw, the server must enforce the exact invariant violated in the captured sequence and regression-test that mutation alongside the normal path.

References