> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/low-level-logic-flaw.md).
# 底层逻辑缺陷
### 业务规则执行缺陷
**实验说明**
这个实验包含一个\*\*采购流程中的逻辑缺陷\*\*。由于交易规则应用不当，可以操纵购物篮的计算，从而以意想不到的价格购买一件“Lightweight l33t 皮夹克”。
提供的标识符：
* **用户：** wiener
* **密码：** peter
**行为分析**
当向购物篮中添加商品时，使用以下查询：
```bash
productId=1&redir=PRODUCT&quantity=99
```
该参数可以被发送 **大量次数** 而不对累积值进行严格控制。
该查询被发送到 **Intruder** 并在其中配置了空负载的 **无限持续** 模式，以及最多 **1 个并发请求**.
经过足够多次迭代后， **购物篮的总价变为负数**.
**问题原因**
漏洞源于有符号 **溢出**。/ 该应用使用了一个 **32 位有符号整数**，其范围是：
* 最小值： `-2 147 483 648`
* 最大值： `2 147 483 647`
当总额超过允许的最大值时， **会因算术溢出而重新计算为负值** 。
**不足的控制**
即使应用在总额小于 0 时阻止支付， **在中间计算过程中也没有进行正确的验证**.
这使你可以调整购物篮，直到得到一个为正但非常低的最终金额。
**最终计算调整**
要获得一个\*\*大于 $0 且小于 $100\*\*的金额，进行以下计算：
* 夹克价格： **$1,337**
* 导致溢出所需的值：\**14 018 329* \*
* 计算：
```bash
14 018 329 / 1337 ≈ 10 484 次
```
批量提交（`数量 = 99`):
```bash
10,484 / 99 ≈ 105 个请求
```
**最终购物车组成**
为了在溢出后获得有效总额：
* **32 123** 每件 1337 美元的夹克
* **21** 每件 60.79 美元的婴儿看护鞋
* **最终总额：** **$54.63**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/low-level-logic-flaw.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.