Study. uk . com
  1. Home
  2. All questions
  3. Question 478

CISSP study material · question 478 of 500

A payments flow lets a user apply a discount code an unlimited number of times because nobody defined which state transitions were disallowed. Which OWASP 2025 category does this fall under?

  1. Injection, since the code is user-supplied input.
  2. Broken Access Control, since the user exceeded their entitlement.
  3. Insecure Design, which explicitly covers business logic flaws such as undefined unwanted state changes.
  4. Security Misconfiguration, since the discount limit was not configured.
Show the answer

Answer: C. Insecure Design, which explicitly covers business logic flaws such as undefined unwanted state changes.

Business logic weaknesses belong in this category, and OWASP's own illustration is an application whose unwanted or unexpected state transitions were never defined.

Source: OWASP Top 10 A06:2025 (OWASP) — OWASP Top 10:2025 A06 Insecure Design > Background

Challenge yourself on this topic → Study as cards