> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/high-level-logic-vulnerability.md).
# 高级逻辑漏洞
### 高级逻辑漏洞
**实验说明**
该实验室没有正确验证用户提供的数据。可以利用购买流程中的逻辑缺陷来更改商品的最终价格。/ 目标是购买 \*\*
提供的标识符：
* **用户**：wiener
* **密码**：peter
**购物篮运作分析**
当商品被添加到购物篮时，发送的请求如下：
```bash
productId=1&redir=PRODUCT&quantity=1
```
该 `数量` 参数由客户端直接控制，且在服务器端没有被正确检查。
**利用逻辑缺陷**
如果将数量改为负值，例如：
```bash
productId=1&redir=PRODUCT&quantity=-1
```
购物篮总额会减少，导致出现负价格（例如，\*\* $1337\*\*）。
但是，在验证购物篮时，应用会通过以下消息阻止这种情况：
> *购物车总价不能小于零*
**绕过限制**
要利用该漏洞：
添加 **目标夹克** 使用一个有效数量：
```bash
productId=1&redir=PRODUCT&quantity=1
```
然后再添加另一个商品，数量为负值，以减少总额：
```bash
productId=2&redir=PRODUCT&quantity=-100
```
这会导致总额大幅变为负数（例如， **-$6241.00**).
调整负数量（例如， `-17`）使最终总额保持 **为正**，但非常低（低于 $100）。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/high-level-logic-vulnerability.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.