> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/business-logic/insufficient-workflow-validation.md).
# Insufficient Workflow Validation
Insufficient Workflow Validation notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Insufficient Workflow Validation
**Description of lab**
This lab is based on incorrect assumptions about the logical sequence of the stages of the purchasing process. The application does not properly verify that all the necessary conditions (including actual payment) have been met before validating an order.
\*\* Target:\*\*/ Use this flaw to buy the product \*\*
**Credentials provided:**
* User: `wiener`
* Password: `peter`
**Analysis of application behaviour**
* When a user tries to pay an item without sufficient credit, the application returns the following error:
```bash
?err=INSUFFICIENT_FUNDS
Not enough store credit for this purchase
```
However, the order confirmation is based only on access to the following URL:
```bash
/cart/order-confirmation?order-confirmed=true
```
* This page does not check whether the payment was actually made or whether the balance was sufficient.
**Operation of the fault**
1. Add to cart an item with a price of **1337 €** (e.g. the targeted jacket).
Do not complete the payment normally (which fails due to lack of credit).
Access directly, via a **GET** request, to the following URL:
`/cart/order-confirmation?order-confirmed=true`
* The application then validates the command without performing additional control.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/business-logic/insufficient-workflow-validation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
