Upgrading a plan without paying the difference

A business-logic flaw breaks no technical control — it exploits a gap in the rules the application enforces. A negative quantity, a coupon applied twice, a step reached out of order, a limit checked in the wrong place: the request is well-formed, but the outcome is one the business never intended.

This lab: Upgrading a plan without paying the difference. Use the feature exactly as built, in an order it never anticipated.

Work it against your own copy of the target. When you have the flag, submit it below.

Find a sequence of legitimate requests that produces an illegitimate result, and drive it to an outcome the flow was meant to prevent. Capture the flag that outcome unlocks.