PHP CVE-2026-30573

Remote unauthenticated attacker can exploit SourceCodester Pharmacy Product Management System 1.0 add-sales.php via HTTP POST requests with negative values in txtprice and txttotalcost parameters. No authentication, user interaction, or special configuration required.

Despite the absence of a CVSS score, this vulnerability presents moderate real-world risk in financial systems. The attack vector is network-accessible and does not appear to require elevated authentication based on the PHP parameter handling described. The presence of publicly available exploit code (POC) lowers the barrier to exploitation. However, real-world impact depends on downstream controls: if the system lacks financial reconciliation, audit trails, or separate approval workflows for unusual transactions, risk is elevated. Conversely, if financial records are reviewed by human auditors or validated against external payment gateways, the fraud may be detected and contained. For organizations deploying this open-source system in production to handle real payments, this represents a critical business logic flaw; for test environments or systems with compensating controls, the risk is reduced. The lack of CVSS scoring reflects the challenge of quantifying business logic vulnerabilities in a generic framework.

An attacker accesses the Pharmacy Product Management System's sales entry interface and submits a sales record with a negative price (e.g., txtprice=-100) and negative total cost. The application accepts these values without validation and records the transaction as-is, reducing the total sales revenue or creating phantom refunds. Over multiple transactions, the attacker systematically manipulates financial records, deflating reported revenue or triggering negative balances that mask theft or fraud. Because the vulnerability is in business logic rather than code execution, the exploit requires no special tools beyond a web browser or curl script to manipulate POST parameters-exploiting it is trivial once the vulnerability is known, which explains the public availability of proof-of-concept code.