Lab: Limit overrun race conditions
Summary: PortSwigger's lab demonstrates a limit overrun race condition in a purchasing flow, where sending the POST /cart/coupon request 20 times in parallel applies a 20% discount code multiple times before the database records that it was already used. The lab requires Burp Suite 2023.9 or higher, and the parallel requests are sent via the Trigger race conditions custom action or by grouping requests in Repeater.
Key Takeaway: The window between applying a discount code and the database update is small, but 20 parallel requests are enough to stack a 20% reduction repeatedly and buy a leather jacket at an unintended price - the same pattern applies to any endpoint where a check and its write are not atomic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026