Business Logic Flaw
High · Logic
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-840
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-840
Definition
Workflow abuse (price tampering, step skipping) without classic inject payload.
Root cause
Missing server-side state/validation of process steps.
Affected components
- Components in the “Logic” class
- Application / API handlers
- Supporting libraries
Impact
Fraud, privilege, inventory abuse.
Severity
High
Safe lab reproduction
Logic-focused web labs
Detection methodology
Abuse-case testing; multi-step flows.
Evidence examples
- Lab reproduction notes: Logic-focused web labs
- Request/response excerpts (redacted)
- Detection signal: Abuse-case testing; multi-step flows
Remediation
Server enforces invariants; idempotency; rate limits.
Secure coding examples
Threat-model checkout/approval flows.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.