PHP CVE-2026-30574

Remote unauthenticated attacker accessing SourceCodester Pharmacy Product Management System 1.0. Attacker manipulates the txtqty parameter in add-sales.php POST request to exceed available stock. No victim interaction required. Affects default installations without input validation patches.

Real-world risk is moderate despite missing CVSS metrics. The vulnerability exhibits several positive exploitation indicators: publicly available proof-of-concept code exists on GitHub demonstrating the overselling technique, the attack vector is likely remote (standard web request to add-sales.php), and no authentication barriers are explicitly mentioned in the description, suggesting unauthenticated or low-privilege access. However, several limiting factors reduce criticality: CVSS scoring is absent, preventing formal severity quantification; EPSS exploitation probability data is unavailable; CISA KEV status indicates no confirmed active exploitation in the wild; and the impact, while operationally disruptive, appears limited to business logic (inventory corruption) rather than confidentiality breaches, authentication bypass, or system compromise. For organizations running this specific pharmacy management system, the combination of public POC availability and straightforward exploitation mechanics (simple parameter manipulation) warrants prioritization for remediation within a standard maintenance cycle. This is not a critical vulnerability requiring emergency patching but rather a notable business logic defect requiring timely correction.

An attacker with access to the pharmacy management system (either as a low-privilege employee or through an exposed web interface) opens the add-sales.php form and submits a sales transaction requesting a quantity far exceeding available stock-for example, requesting 1,000 units of a medication where inventory shows only 50 units. The application processes the request without validation, creating a sales record and reducing inventory to a negative value. If repeated across multiple products, this causes widespread inventory corruption, prevents accurate stock tracking, and may trigger supply chain disruptions as the organization attempts to fulfill orders that cannot be met. Public exploit code on GitHub documents this exact manipulation technique, reducing the barrier to exploitation.