Configuration: Business Logic (Negative Value)¶

Identifier: negative_value

Scanner Support¶

Description¶

Applications that accept zero or negative values for economic fields such as price, quantity, or cost can allow attackers to manipulate business logic, bypass payment checks, or corrupt financial data.

How we test: We send mutation requests with zero and negative values in parameters named price, quantity, or cost and analyze whether the server accepts them with a successful response instead of rejecting the invalid input.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  negative_value:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.