Is it considered a security vulnerability if it is possible to buy things for free in an online shop?

Question

Let's imagine the following: There is a web shop and they have a 5$ off coupon code. The intention is that you can use this code only once. But it is possible to use it multiple times so you can buy everything for free. Is this considered a security vulnerability? I know it's not like a buffer overflow or sql injection. But there is something wrong in the code.

I had this this week. A big software company we all know was/is affected. They must have been/must be losing $10.000s (the bug is public). I reported it as security vulnerability. I said I want a bug bounty. But it was rejected. They said it was not a security bug but a normal bug. What do you think?

(I don't want to say what exactly it was because I don't want to spread security vulnerabilities.)

Answer 1

This is usually called a "business logic flaw" or "business logic exploit" and yes, these are usually considered "security vulnerabilities", depending on what you are able to do with them. For example, redeeming a voucher multiple times can be considered an exploit, because it might not ring any alarm bells if someone placed three orders in a month, all with a -5 USD voucher. Yes, the "gain" to the attacker is only 10 USD, but it's still an exploit.

However, just because you are able to place an order "for free" doesn't mean that the company will actually honor that order. Remember that an order in an online store is a contract and likely subject to the company's Terms of Service. Those may (and likely do) include a clause, stating that they can reject orders for a variety of reasons, including fraudulent orders. And depending on the jurisdiction, trying to redeem the same coupon 5000 times to get a 25,000 USD item "for free" will likely be considered "fraudulent".

In short

Yes, such things are vulnerabilities.

No, they are not automatically resulting in financial damage to the company.