CVE-2026-30573

Published: Apr 1, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is located in the add-sales.php file. The application fails to validate the "txtprice" and "txttotalcost" parameters, allowing attackers to submit negative values for sales transactions. This leads to incorrect financial calculations, corruption of sales reports, and potential financial loss.

Affected (1)

Products: Senior Walter: Web Based Pharmacy Product Management System

1 product

Web Based Pharmacy Product Management System

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Senior Walter Web Based Pharmacy Product Management System	Version 1.0

Related CWEs

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (1)

https://github.com/meifukun/Web-Security-PoCs/blob/main/Pharmacy-Product-Management-System/Logic-AddSales-NegativePrice.md

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.