In 2017, a researcher discovered that a major airline's flight booking system had a business logic flaw: the final payment step sent the ticket price in the request body. The server used whatever number it received. You could change the price to $0.00 and receive a valid booking confirmation for a real flight — the system would even send a confirmation email.

This is not hypothetical. Variants of this flaw have been found in airline booking systems, e-commerce platforms, subscription services, and banking applications. The pattern is always the same: the server trusts a value from the client that it should have calculated itself.

In every case, no hacking tools were needed. The attackers understood how the application was supposed to work — and then found the gap between that and how it actually worked.