← back to room
Business Logic

Checkout Logic Bugs

Scenario

Quantity fields accept integers but negative values are not rejected. A negative count subtracts from the cart total instead of adding. Checkout with a quantity below zero and receive money back on paper.

Your approach

  1. Add a product and capture the checkout request.
  2. Set quantity to a negative number in the intercepted form.
  3. Submit and verify the order total becomes abnormally low or negative.
  4. Copy the negative quantity flag from the lab response.
  5. Submit that flag.
The checkout form posts price, qty, and coupon. Tamper them. Coupon code: SAVE50.

Pro hoodie — $49.99

Hint: edit the hidden price field (DevTools) or set qty negative.