Apprentice
← all rooms
Business Logic Medium

Business Logic Bugs

Tamper price, reuse coupons, break quantities.

Mission briefing

ShopWave is a flash-sale storefront with coupons and a one-click checkout. Prices and quantities arrive from hidden form fields the client can edit. Try to complete orders that should be impossible under normal business rules.

0 / 3 tasks 0 / 30 pts

Objectives

  • Zero-price checkout
  • Reuse coupon
  • Negative quantity
Task 1 Price tamper Low 10 pts

Scenario

ShopWave checkout posts item price in a hidden field the browser can edit. The server charges whatever price arrives in the form. Complete a purchase while paying zero.

Your approach

  1. Add an item to cart and intercept the checkout POST.
  2. Change the hidden price field to zero before submitting.
  3. Complete the order and read the confirmation page.
  4. Copy the price-tamper flag from the success message.
  5. Submit that flag.

Buy with price 0.

Open lab →
Hint

Edit hidden price field to 0

Task 2 Coupon reuse Medium 10 pts

Scenario

Coupons like SAVE50 should apply only once per checkout session. The server never tracks whether a code was already used on the same cart. Stack the same discount twice on one order.

Your approach

  1. Start checkout with a single valid coupon applied.
  2. Apply the same coupon code again through the API or form.
  3. Confirm the total drops further than a single use allows.
  4. Read the coupon reuse flag on success.
  5. Submit that flag.

Apply SAVE50 twice.

Open lab →
Task 3 Negative qty Medium 10 pts

Scenario

Quantity fields accept integers but negative values are not rejected. A negative count subtracts from the cart total instead of adding. Checkout with a quantity below zero and receive money back on paper.

Your approach

  1. Add a product and capture the checkout request.
  2. Set quantity to a negative number in the intercepted form.
  3. Submit and verify the order total becomes abnormally low or negative.
  4. Copy the negative quantity flag from the lab response.
  5. Submit that flag.

Checkout with negative quantity.

Open lab →