Bugs in the rules, not the code

A normal checkout

The store checkout at /app/checkout multiplies price by quantity:

curl -s http://127.0.0.1:8080/app/checkout
curl -s -d 'item=hoodie&qty=2' http://127.0.0.1:8080/app/checkout

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8080/app/checkout
Store items: sticker (3 credits), hoodie (45 credits), laptop (1200 credits)
POST item= and qty= to check out.
student@vulntech:~$ curl -s -d 'item=hoodie&qty=2' http://127.0.0.1:8080/app/checkout
Order: 2 x hoodie = 90 credits

Everything is “working” — no injection, no crash. Business-logic bugs live in the assumptions: here, that a quantity is always a positive number.