Browse / Business Logic

Business Logic

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Business Logic Errors415
• Time-of-check Time-of-use (TOCTOU) Race Condition25
• Modification of Assumed-Immutable Data (MAID)19
• Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')18
• Expected Behavior Violation4
• External Control of Critical State Data3
• Incorrect Comparison2
• Leveraging Race Conditions1
• Partial String Comparison1

Often found together with

• Misconfiguration48
• Denial of Service38
• Information Disclosure37

Most upvoted Business Logic reports

AllValidInformativeN/ADuplicate

1. CSP Bypass and escalation of https://hackerone.com/reports/2279346N/ABusiness Logic Errors · high · PortSwigger Web Security
   48 votes
2. curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download writeN/ATime-of-check Time-of-use (TOCTOU) Race Condition · medium · curl
   42 votes
3. Not a Vuln: Race Condition Allows Creation of Multiple Organizations with the Same NameN/ABusiness Logic Errors · WakaTime
   40 votes
4. curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer HijackN/ATime-of-check Time-of-use (TOCTOU) Race Condition · critical · curl
   30 votes
5. libcurl cache updates follow symlinks and truncate their targetsN/ATime-of-check Time-of-use (TOCTOU) Race Condition · low · curl
   23 votes
6. TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation BypassN/ATime-of-check Time-of-use (TOCTOU) Race Condition · high · curl
   23 votes
7. Missing applicability validation allows non-applicable HTTPS RR to reach ECH processingN/ABusiness Logic Errors · medium · curl
   22 votes
8. Hi HackerN/ABusiness Logic Errors · curl
   22 votes
9. curl --continue-at confusionN/ABusiness Logic Errors · medium · curl
   14 votes
10. A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.N/ABusiness Logic Errors · low · curl
    12 votes
11. TLS peer-verification bypass via mid-transfer ssl_config mutationN/ABusiness Logic Errors · curl
    11 votes
12. Mathematical error found in meals for oneN/ABusiness Logic Errors · Eternal
    10 votes
13. Business logic errorN/ABusiness Logic Errors · low · UPchieve
    9 votes
14. curl/libcurl vulnerable to TLS truncation attacksN/ABusiness Logic Errors · medium · curl
    8 votes
15. Email Spoofing Possible on djangoproject.com Email DomainN/ABusiness Logic Errors · medium · Django
    8 votes
16. CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entryN/AExpected Behavior Violation · low · curl
    6 votes
17. Error Page Content Spoofing or Text InjectionN/ABusiness Logic Errors · Judge.me
    6 votes
18. Activat burp suite pro with the old license after transfared to anothe accountN/ABusiness Logic Errors · PortSwigger Web Security
    6 votes
19. CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 charsN/ABusiness Logic Errors · medium · curl
    4 votes
20. Email Verification Bypass And Get access to user's private invitation.N/ABusiness Logic Errors · medium · Reddit
    3 votes
21. Global defaming of any twitter userN/ABusiness Logic Errors · critical · X / xAI
    3 votes
22. Email Spoofing Possible on torproject.org Email DomainN/ABusiness Logic Errors · medium · Tor
    3 votes
23. Certificate authentication re-use on redirectN/ABusiness Logic Errors · medium · curl
    2 votes
24. KRB-FTP: Security level downgradeN/ABusiness Logic Errors · curl
    1 votes
25. Returning back from the browser after logging off will disclose some informationN/ABusiness Logic Errors · Liberapay
    1 votes
26. matchN/AExternal Control of Critical State Data · high · curl