Lab: Insufficient workflow validation
Summary: PortSwigger's Web Security Academy lab describes a shopping workflow that assumes events happen in order: after checkout, the POST /cart/checkout request redirects to an order confirmation page. By sending GET /cart/order-confirmation?order-confirmation=true directly in Burp Repeater after adding the leather jacket to the basket, the order completes without the store credit being deducted.
What you should know: The confirmation step is treated as proof of payment, so anyone who can reach that URL skips the charge entirely - a workflow flaw that costs the merchant the full price of every item ordered this way.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026