Vulnerability Summary
Writeup — Business Logic Vulnerability
A grocery-delivery platform's GraphQL API trusted a client-supplied paymentMethod value during the order update flow without re-validating authorization for that method. By starting an order with a card that was guaranteed to decline, letting it drop into a PENDING state, and then intercepting the "fix payment" request to swap CARD → INVOICE, an authenticated low-privilege user could push the order to CONFIRMED and into fulfillment without any payment ever being processed.
The bug was a Business Logic vulnerability that allowed users to access paid features while they were on a free plan.
No comments yet.
Be the first to share your thoughts
Log in to join the discussion.
Sign In