Business Logic Errors · passage 3 of 11

Review Feature Testing

Text · Business Logic Errors/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* Assess if you can post a product review as a verified reviewer without having purchased the item. * Attempt to provide a rating outside of the standard scale, for instance, a 0, 6 or negative number in a 1 to 5 scale system. * Test if the same user can post multiple ratings for a single product. This is useful in detecting potential race conditions. * Determine if the file upload field permits all extensions; developers often overlook protections on these endpoints. * Investigate the possibility of posting reviews impersonating other users. * Attempt Cross-Site Request Forgery (CSRF) on this feature, as it's frequently unprotected by tokens.

Every one of the 11 is a mark on the map. Named now: 1 to 11, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.