Browse / Business Logic

Business Logic

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Business Logic Errors415
• Time-of-check Time-of-use (TOCTOU) Race Condition25
• Modification of Assumed-Immutable Data (MAID)19
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')18
• Expected Behavior Violation4
• External Control of Critical State Data3
• Incorrect Comparison2
• Leveraging Race Conditions1
• Partial String Comparison1

Often found together with

• Misconfiguration48
• Denial of Service38
• Information Disclosure37

Most upvoted Business Logic reports

AllValidInformativeN/ADuplicate

1. Modify in-flight data to payment provider Smart2PayBusiness Logic Errors · critical · Valve
   $7,500443 votes
2. H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsBusiness Logic Errors · medium · Shopify
   372 votes
3. Hackerone is not properly deleting user idBusiness Logic Errors · medium · HackerOne
   356 votes
4. Double Payout via PayPalBusiness Logic Errors · critical · Coinbase
   $10,000324 votes
5. Getting New Invitations without Leaving ProgramsBusiness Logic Errors · low · HackerOne
   322 votes
6. [fleet.city-mobil.ru] Driver balance increasingBusiness Logic Errors · Mail.ru
   319 votes
7. Race Condition allows to redeem multiple times gift cards which leads to free "money"Business Logic Errors · high · Reverb.com
   308 votes
8. An attacker can run pipeline jobs as arbitrary userBusiness Logic Errors · critical · GitLab
   $12,000307 votes
9. Ethereum account balance manipulationBusiness Logic Errors · critical · Coinbase
   276 votes
10. Ability to bypass partner email confirmation to take over any store given an employee emailTime-of-check Time-of-use (TOCTOU) Race Condition · critical · Shopify
    $15,250273 votes
11. An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossBusiness Logic Errors · high · Semrush
    267 votes
12. Fee discounts can be redeemed many times, resulting in unlimited fee-free transactionsBusiness Logic Errors · medium · Stripe
    $5,000266 votes
13. Change phone number OTP flaw leads to any phone number takeoverBusiness Logic Errors · critical · inDrive
    $2,000241 votes
14. Race condition in performing retest allows duplicated paymentsConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium · HackerOne
    240 votes
15. [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s) Business Logic Errors · medium · Eternal
    229 votes
16. Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into stateBusiness Logic Errors · medium · Superhuman (formerly Grammarly)
    223 votes
17. ETH contract handling errorsBusiness Logic Errors · critical · Coinbase
    208 votes
18. HackerOne making payments in USDC (Coinbase stable coin)Business Logic Errors · HackerOne
    201 votes
19. Able to approve admin approval and change effective status without adding payment details . Business Logic Errors · high · Reddit
    $5,000191 votes
20. adding h1_analyst_* to username for normal users Business Logic Errors · low · HackerOne
    $500187 votes
21. OLO Total price manipulation using negative quantitiesBusiness Logic Errors · critical · Upserve
    167 votes
22. Abusing "Report as abuse" functionality to delete any user's post.Business Logic Errors · Vanilla
    $300160 votes
23. 2-factor authentication can be disabled when logged in without confirming account passwordBusiness Logic Errors · medium · Localize
    159 votes
24. Takeover of Twitter-owned domain at mobileapplinking.comBusiness Logic Errors · X / xAI
    159 votes
25. Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comBusiness Logic Errors · low · HackerOne
    154 votes
26. Race Condition leads to undeletable group memberTime-of-check Time-of-use (TOCTOU) Race Condition · low · HackerOne
    153 votes
27. Steal collateral during `end` process, by earning DSR interest after `flow`.Business Logic Errors · high · BlockDev Sp. Z o.o
    152 votes
28. Bypassing CORS Misconfiguration Leads to Sensitive ExposureBusiness Logic Errors · medium · U.S. Dept Of Defense
    145 votes
29. [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposureInformativeBusiness Logic Errors · BlockDev Sp. Z o.o
    140 votes
30. Bypassing HackerOne 2FA due to race conditionBusiness Logic Errors · medium · HackerOne
    139 votes
31. Race condition in activating email resulting in infinite amount of diamonds receivedTime-of-check Time-of-use (TOCTOU) Race Condition · InnoGames
    $2,000137 votes
32. worki.ru: SMS code bruteforceBusiness Logic Errors · Mail.ru
    $1,657136 votes
33. [api.zomato.com] Able to manipulate order amountBusiness Logic Errors · high · Eternal
    136 votes
34. Business Logic Error – Bypass of OTP Verification During Signup on hover.comBusiness Logic Errors · Tucows (VDP)
    135 votes
35. Add upto 10K rupees to a wallet by paying an arbitrary amountBusiness Logic Errors · high · Eternal
    $2,000132 votes
36. Able to manipulate order amount by removing cancellation amount and cause financial impactBusiness Logic Errors · high · Eternal
    130 votes
37. Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended ProductsBusiness Logic Errors · medium · TikTok
    $1,000129 votes
38. Non-premium user can disable Ads in japanese version of dic.pixiv.netBusiness Logic Errors · high · pixiv
    $3,000123 votes
39. Any user could upload attachments to pentest scoping form they don't have access toBusiness Logic Errors · high · HackerOne
    121 votes
40. Account recovery text message is sending a wrong domain to users.Business Logic Errors · low · HackerOne
    117 votes
41. @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.Business Logic Errors · medium · HackerOne
    117 votes
42. critical server misconfiguration lead to access to any user sensitive data which include user email and passwordBusiness Logic Errors · medium · Flickr
    $500116 votes
43. Availing Zomato gold by using a random third-party `wallet_id`Business Logic Errors · critical · Eternal
    $2,000116 votes
44. Race Condition when following a userConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low · Staging.every.org
    113 votes
45. [help.steampowered.com] Account takeover bruteforcing SteamGuardBusiness Logic Errors · high · Valve
    $2,500112 votes
46. Unlimited fake rate to the passenger in city to city, Affected endpoint `/api/v1/reviews/ride/<ID>/driver`Business Logic Errors · medium · inDrive
    110 votes
47. Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Business Logic Errors · critical · X / xAI
    106 votes
48. [stories.showmax.com] Cross Origin Misconfiguration - Sensitive Information ExposureBusiness Logic Errors · Showmax
    104 votes
49. Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding featureBusiness Logic Errors · medium · HackerOne
    $2,500103 votes
50. Subdomain takeover of fr1.vpn.zomans.comBusiness Logic Errors · medium · Eternal
    $35099 votes
51. s3 bucket takeover presented in https://github.com/reddit/rpan-studio/blob/e1782332c75ecb2f774343258ff509788feab7ce/CI/full-build-macos.shBusiness Logic Errors · high · Reddit
    96 votes
52. Race Condition Enables Bypassing Verification CheckConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · high · Tools for Humanity
    $3,00095 votes
53. Race Condition in Flag SubmissionConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low · HackerOne
    94 votes
54. Race condition on add 1 free domainBusiness Logic Errors · medium · Automattic
    93 votes
55. Cloud Computer Hackerone Triager can be Accessible for everyone [[email protected]] computerInformativeBusiness Logic Errors · HackerOne
    91 votes
56. Multiple vulnerability leading to account takeover in TikTok SMB subdomain.Business Logic Errors · critical · TikTok
    91 votes
57. Misconfigured oauth leads to Pre account takeover Business Logic Errors · low · Bumble
    90 votes
58. Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”Business Logic Errors · medium · Frontegg
    88 votes
59. Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signingBusiness Logic Errors · medium · MetaMask
    $35086 votes
60. Bypass Email verification for monitoring at `monitor.mozilla.org`Business Logic Errors · medium · Mozilla
    85 votes
61. Ability to getting Twitter Blue verified badge without purchase itDuplicateBusiness Logic Errors · medium · X / xAI
    85 votes
62. Bypass invite accept for victimBusiness Logic Errors · medium · Slack
    84 votes
63. No rate limiting for confirmation email lead to huge Mass mailingsBusiness Logic Errors · medium · Nextcloud
    82 votes
64. Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceBusiness Logic Errors · medium · Uber
    82 votes
65. Manipulating response leads to free access to Streamlabs Prime Business Logic Errors · medium · Logitech
    80 votes
66. Business Logic Bypass Allows Setting “Read Access” Role Without Pro Plan SubscriptionBusiness Logic Errors · medium · Lovable VDP
    78 votes
67. [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business lossBusiness Logic Errors · high · Eternal
    78 votes
68. IDOR - Scheduled data leak to other accounts By "projectID"Business Logic Errors · medium · SingleStore
    77 votes
69. Domain pointing to vimeo portfolio are prone to takeover using on-demand.Business Logic Errors · high · Vimeo
    77 votes
70. Exposure of shopify employee summit page allows anonymous user to place orders for free booksInformativeBusiness Logic Errors · Shopify
    76 votes
71. Asset Inventory Internal Descriptions are leaked in CSV exportBusiness Logic Errors · medium · HackerOne
    76 votes
72. Race Condition of Transfer data Credits to Organization Leads to Add Extra free Data Credits to the OrganizationBusiness Logic Errors · medium · Helium
    $25074 votes
73. Дюп предметов lootdog и возможность их продавать.Business Logic Errors · Mail.ru
    $5,00073 votes
74. Race condition in joining CTF groupTime-of-check Time-of-use (TOCTOU) Race Condition · low · HackerOne
    $50072 votes
75. Availability Impact from Exploiting Project Name VulnerabilitiesBusiness Logic Errors · low · Doppler
    $25071 votes
76. Subdomain takeover of images.crossinstall.comBusiness Logic Errors · high · X / xAI
    71 votes
77. Improper use of "path" parameter can be used to trick testers into leaking their Front-End PoCBusiness Logic Errors · BugPoC
    $1,00071 votes
78. myshopify.com domain takeoverBusiness Logic Errors · medium · Shopify
    71 votes
79. Claiming ownership of GitHub handles via forked GitHub gists.Business Logic Errors · Keybase
    $1,00071 votes
80. Exceed the maximum number of subscribers using Race Condition Business Logic Errors · low · SingleStore
    70 votes
81. Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*Business Logic Errors · high · LinkedIn
    70 votes
82. WordPress Plugin Update Confusion at trafficfactory.comBusiness Logic Errors · low · Traffic Factory
    $20070 votes
83. Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████Business Logic Errors · low · AWS VDP
    69 votes
84. Session works after logout from Shopify accountConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · low · Shopify
    69 votes
85. attacker can book unlimited tickets in free at https://aaf.com/checkout/order-received/21237/?key=wc_order_5bbef48fa35b2Business Logic Errors · high · Alliance of American Football
    68 votes
86. Lack of payment type validation in dial.uber.com allows for free ridesBusiness Logic Errors · high · Uber
    68 votes
87. Bypass subscriptionBusiness Logic Errors · medium · Imgur
    67 votes
88. Unlock underage blocked app without support interaction using airplane modeBusiness Logic Errors · low · Tools for Humanity
    $30066 votes
89. Race Condition in Folder Creation Allows Bypassing Folder LimitBusiness Logic Errors · medium · Dust
    65 votes
90. Improper input validation in emoji field leads to sidebar UI denial of serviceBusiness Logic Errors · low · Nextcloud
    64 votes
91. Minor security issue with Hackerone Invitations from sandbox programBusiness Logic Errors · low · HackerOne
    64 votes
92. Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changesBusiness Logic Errors · medium · Nextcloud
    $15063 votes
93. Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative BalanceBusiness Logic Errors · medium · Bykea
    63 votes
94. Earn free DAI interest (inflation) through instant CDP+DSR in one txBusiness Logic Errors · high · BlockDev Sp. Z o.o
    63 votes
95. Exceeding the limit of Workspaces via Race ConditionBusiness Logic Errors · medium · SingleStore
    62 votes
96. Attacker can add two free bags offered by the site at the same time.Business Logic Errors · medium · Mars
    62 votes
97. Incorrect logic when buy one more license which may lead to extend the expire date of existing licenseInformativeBusiness Logic Errors · PortSwigger Web Security
    61 votes
98. Race condition in faucet when using starportBusiness Logic Errors · critical · Cosmos
    $5,00061 votes
99. Bypassing x profile verification to receive instant blue checkmark and unlimited profile changesBusiness Logic Errors · low · X / xAI
    $25060 votes
100. Steam chat - trade offer presentation vulnerabilityBusiness Logic Errors · medium · Valve
     60 votes