Flawed enforcement of business rules

 This vulnerability demonstrates a flawed enforcement of business rules, where the application attempts to restrict coupon usage but fails to properly enforce constraints across multiple inputs. Instead of validating discount rules in a centralized and secure manner, the system relies on weak state tracking in the frontend or session logic, which can be bypassed by alternating inputs in a specific sequence.

The application provides two discount mechanisms: a fixed welcome coupon (NEWCUST5) and a newsletter signup coupon (SIGNUP30). Both coupons are intended to be used under certain limitations, typically with restrictions such as one-time use or single application per order. However, the enforcement of these rules is inconsistent. When a user applies the same coupon code twice consecutively, the system correctly rejects the second attempt, indicating that some form of duplicate detection exists. This suggests that the application is tracking previously applied coupons, but only in a simplistic or session-based manner.

The vulnerability becomes exploitable when testing how the system handles multiple different coupons. After adding an item (the leather jacket) to the cart and proceeding to checkout, the user applies both coupon codes. Initially, each code successfully reduces the total price. However, instead of properly enforcing a global rule that limits total discount usage or prevents repeated stacking beyond intended limits, the system only checks for immediate repetition of the same coupon. This means that alternating between NEWCUST5 and SIGNUP30 bypasses the duplicate detection mechanism.

By repeatedly switching between the two valid coupon codes, the application incorrectly continues to apply additional discounts. This behavior indicates that the backend does not maintain a robust record of cumulative discount usage or enforce a rule such as “each coupon can only be applied once per order.” Instead, it likely performs validation only on the last submitted input rather than evaluating the full state of applied discounts.

As a result, the total order value can be gradually reduced beyond the intended promotional limits. By repeatedly alternating the coupons enough times, the price can be lowered below the available store credit balance. Once the total reaches a sufficiently low value, the user can complete the purchase successfully, effectively exploiting the system’s broken discount logic to gain unintended financial advantage.

The root cause of this vulnerability is poor business logic design and stateless validation of coupon usage. The application fails to treat coupon application as a cumulative state that must be strictly controlled. Instead, it validates inputs individually without enforcing consistent rules across the entire transaction lifecycle. A secure implementation would track all applied coupons server-side in a structured way, ensuring each coupon is applied only once per order and enforcing a maximum discount threshold regardless of input order or repetition pattern.

This issue highlights an important principle in application security: business rules must be enforced atomically and server-side, not through simple input checks or client-dependent state. When validation depends on request sequence or client behavior, attackers can manipulate the logic flow to bypass intended restrictions.