Web applications are subject to business logic attacks, according to a report by Imperva.
http://net-security.org/secworld.php?id=12295