> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/insufficient-workflow-validation.md).
# 工作流验证不足
工作流验证不足，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 工作流验证不足
**实验描述**
本实验基于对采购流程各阶段逻辑顺序的错误假设。应用程序在确认订单之前，没有正确验证所有必要条件（包括实际付款）是否已经满足。
\*\*目标：\*\*利用此漏洞购买该产品
**提供的凭据：**
* 用户： `wiener`
* 密码： `peter`
**应用行为分析**
* 当用户尝试在余额不足的情况下支付商品时，应用程序会返回以下错误：
```bash
?err=INSUFFICIENT_FUNDS
本次购买的商店余额不足
```
然而，订单确认仅基于访问以下 URL：
```bash
/cart/order-confirmation?order-confirmed=true
```
* 此页面不会检查是否已实际付款，或者余额是否充足。
**漏洞运作方式**
1. 将一件价格为 **1337 €** （例如目标夹克）。
不要正常完成支付（由于余额不足会失败）。
通过一个 **GET** 请求，直接访问以下 URL：
`/cart/order-confirmation?order-confirmed=true`
* 然后，应用程序会在不执行额外检查的情况下验证该命令。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/insufficient-workflow-validation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
