What is the CVSS score of CVE-2026-30573?

CVE-2026-30573 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30573?

Yes, a public proof-of-concept exploit is available for CVE-2026-30573. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-30573

EUVD-2026-17901 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-04-01 mitre

Information Disclosure PHP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 12:06 vuln.today

Public exploit code

EUVD ID Assigned

Apr 01, 2026 - 15:00 euvd

EUVD-2026-17901

Analysis Generated

Apr 01, 2026 - 15:00 vuln.today

CVE Published

Apr 01, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is located in the add-sales.php file. The application fails to validate the "txtprice" and "txttotalcost" parameters, allowing attackers to submit negative values for sales transactions. This leads to incorrect financial calculations, corruption of sales reports, and potential financial loss.

AnalysisAI

Pharmacy Product Management System 1.0 accepts negative price and total cost values in sales transactions due to insufficient input validation in add-sales.php, enabling attackers to manipulate financial records, corrupt sales reports, and cause financial loss. The vulnerability allows unauthenticated or low-privilege users to submit arbitrary negative values that bypass business logic controls. Publicly available exploit code exists demonstrating this business logic flaw.

Technical ContextAI

The vulnerability exists in a PHP-based web application (SourceCodester Pharmacy Product Management System) that processes sales transactions. The add-sales.php file handles transaction data including price and total cost parameters (txtprice and txttotalcost). The root cause is a business logic validation failure-the application accepts numeric input without enforcing domain constraints (non-negative values). Unlike injection or authentication flaws, this attack exploits inadequate business rule enforcement at the application layer. Negative price submissions cause the application to record inverted financial transactions, corrupting ledgers and enabling fraudulent financial manipulation.

RemediationAI

Implement strict input validation in add-sales.php to enforce non-negative values for txtprice and txttotalcost parameters. At minimum, add server-side validation to reject any submission where price or total cost is less than zero, and return an error message to the user. Consider implementing range checks (e.g., maximum reasonable price per item) and type enforcement (numeric, non-null). Additionally, implement business logic controls such as manual approval workflows for large or unusual transactions, and maintain immutable audit logs of all sales modifications. If this is an open-source deployment, check the GitHub repository for patched versions; the PoC reference (https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-NegativePrice.md) may also contain community-contributed fixes. For immediate mitigation, restrict add-sales.php access to trusted administrators only via network-level controls or authentication gating.