> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/business-logic-vulnerabilities/high-level-logic-vulnerability.md). # High-level logic vulnerability

Let's click on the `My account` button and login using the following credentials: | Username | Password | | -------- | -------- | | wiener | peter |

Now we can add the "Lightweight l33t leather jacket" to our cart.

Since we are proxying the traffic through Burp Suite, we can go `Proxy > HTTP History` to view the request.

Let's forward this request to the `Repeater` for further modification. Once in the `Repeater`, we can set the `quantity` parameter to the following: ``` -2 ```

Let's go back to our cart in the browser.

We can see that the `quantity` has gone from 1 to -1 since we set the `quantity` parameter to -2. Also the price is now negative. Next, we have to set the `quantity` back to 1 and add another product ("The Trolley-ON") to the cart.

We can view this request in the `Proxy > HTTP History` tab.

Let's forward it to the `Repeater`. Inside the `Repeater` set the `quantity` parameter to the following and send the request: ``` -22 ```

Let's check out our cart.

We can see that the quantity of "The Trolley-ON" has gone from 1 to -21. More importantly the price which in in negative has been subtracted from the jacket's price and the total is now lower than our credits. Let's buy the products.

We have solved the lab.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/server-side-topics/business-logic-vulnerabilities/high-level-logic-vulnerability.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.