> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/high-level-logic-vulnerability.md).
# 高级逻辑漏洞
高级逻辑漏洞，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 高级逻辑漏洞
**实验描述**
该实验室没有正确验证用户提供的数据。可以利用购买过程中的逻辑缺陷来更改商品的最终价格。/ 目标是购买 \*\*
提供的标识符：
* **用户**: wiener
* **密码**: peter
**购物篮操作分析**
当商品被添加到购物篮时，发送的请求如下：
```bash
productId=1&redir=PRODUCT&quantity=1
```
该 `quantity` 参数由客户端直接控制，在服务器端没有得到正确检查。
**利用该逻辑缺陷**
如果将数量改为负值，例如：
```bash
productId=1&redir=PRODUCT&quantity=-1
```
购物篮的总金额会减少，导致出现负价格（例如，\*\* $1337\*\*）。
然而，在验证购物篮时，应用会用以下消息阻止这种情况：
> *购物车总价不能小于零*
**绕过限制**
要利用该漏洞：
添加 **目标夹克** 使用一个有效数量：
```bash
productId=1&redir=PRODUCT&quantity=1
```
然后再添加另一个数量为负的商品来降低总价：
```bash
productId=2&redir=PRODUCT&quantity=-100
```
这会导致总价变成一个很大的负数（例如 **-$6241.00**).
调整负数金额（例如 `-17`）以使最终总价保持 **为正**，但非常低（低于 $100）。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/high-level-logic-vulnerability.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)