业务逻辑漏洞的测试方法与修复策略案例研究  

Case Study on Testing Methods and Repair Strategies for Business Logic Vulnerabilities

作　　者：沈华锋 王昕葳 周宬 王少青 Shen Huafeng;Wang Xinwei;Zhou Cheng;Wang Shaoqing(Jiaxing Nanyang Polytechnic Institute,Jiaxing,Zhejiang 314000,China;Jiaxing Public Security Bureau;Jiaxing News Media Center)

机构地区：[1]嘉兴南洋职业技术学院,浙江嘉兴314000 [2]嘉兴市公安局 [3]嘉兴市新闻传媒中心

出　　处：《计算机时代》2025年第1期32-35,41,共5页Computer Era

基　　金：嘉兴南洋职业技术学院2024年度校级课题“业务逻辑漏洞案例研究”(立项号Qt24001)。

摘　　要：业务逻辑漏洞是在程序设计与开发过程中,由于应用自身的业务流程存在逻辑缺陷而产生的一种隐蔽性极强的系统级漏洞。业务逻辑漏洞可按照业务流程的功能模块进行分类,包括登录认证、密码找回、验证码、业务流程、业务接口调用、业务办理等,常用测试工具有Burp Suite、htpwdScan和JSFinder。本文以共享汽车的免费租用场景作为逻辑漏洞应用案例进行了分析和测试,展示了漏洞检测从业务逻辑视角的重要性和方法创新。Business logic vulnerabilities are highly covert system level vulnerabilities that arise during the process of program design and development due to logical flaws in the application's own business processes.Business logic vulnerabilities can be classified according to the functional modules of business processes,including login authentication,password retrieval,verification codes,business processes,business interface calls,business processing,etc.Common testing tools include Burp Suite,htpwdScan,and JSFinder.This article analyzes and tests the free rental scenario of car-sharing as a logic vulnerability application case,showing the importance and methodological innovation of vulnerability testing from a business logic perspective.

关 键 词：逻辑漏洞 漏洞测试 短信炸弹 垂直越权 漏洞修复 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]