CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A penetration tester observes that a web application changes the price of an item by intercepting a request and modifying the 'price' field from 99.99 to 0.01. The server accepts and processes the modified price. What OWASP category does this represent?
- A.A01: Broken Access Control / Business Logic Flaw - the server trusts client-supplied financial data without recalculating it from authoritative server-side sources
- B.A03: Injection - the modified price is injected data
- C.A02: Cryptographic Failures - the price should be encrypted in transit
- D.A05: Security Misconfiguration - the server should have input validation enabled
Why A is correct
Trusting client-supplied price or quantity data is a business logic vulnerability under A01 Broken Access Control. Proper design requires the server to look up the authoritative price from the database using the item ID and calculate the total server-side, ignoring any client-supplied price. This is one of the most common and impactful vulnerabilities in e-commerce applications.
Know someone studying for Web App Fundamentals? Send them this one.