> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/insufficient-workflow-validation.md).
# 工作流验证不足
### 工作流验证不足
**实验说明**
该实验室基于对购买流程各阶段逻辑顺序的错误假设。应用在验证订单之前，并未正确检查所有必要条件（包括实际付款）是否已经满足。
\*\* 目标：\*\*/ 利用此缺陷购买该产品 \*\*
**提供的凭据：**
* 用户： `wiener`
* 密码： `peter`
**应用行为分析**
* 当用户尝试在信用不足的情况下支付商品时，应用会返回以下错误：
```bash
?err=INSUFFICIENT_FUNDS
商店信用不足，无法完成此次购买
```
但是，订单确认仅基于访问以下 URL：
```bash
/cart/order-confirmation?order-confirmed=true
```
* 此页面不会检查付款是否 वास्तव完成，或者余额是否充足。
**缺陷的运作方式**
1. 向购物车中添加一件价格为 **1337 €** （例如，目标夹克）。
不要正常完成付款（由于信用不足，这会失败）。
直接通过一个 **GET** 请求，访问以下 URL：
`/cart/order-confirmation?order-confirmed=true`
* 随后，应用在不进行额外检查的情况下验证该命令。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/insufficient-workflow-validation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.