A business logic vulnerability in the SourceCodester Pharmacy Product Management System 1.0 allows for the manipulation of financial transactions, creating significant risk for data integrity and revenue loss.

The vulnerability resides in the add-sales.php file, where the application fails to perform proper server-side validation on the txtprice and txttotalcost parameters. An unauthenticated attacker can supply negative values to these fields, resulting in corrupted financial reports and inaccurate sales records.

The ability to inject negative values into financial parameters poses a direct threat to the financial integrity of the organization. Because this vulnerability allows for the corruption of sales data and potential financial manipulation, it is rated with a CVSS score of 7.5 (High). Such flaws can lead to significant operational disruption, audit failures, and direct financial losses if exploited at scale.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the affected add-sales.php file or the entire application to trusted networks only.

Proactive Monitoring: Security teams should monitor database logs for anomalous sales entries, specifically looking for transactions containing negative values or unexpected numeric inputs in price fields.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect incoming HTTP requests and block any POST requests to add-sales.php that contain negative numeric values in the specified parameters.

Public Exploit Available: Yes, a published proof-of-concept exists in a security researcher's write-up referenced in the CVE record.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability represents a credible threat to business operations. Organizations currently running version 1.0 should prioritize neutralizing the affected endpoint via access controls or WAF rules until a formal patch is released by the vendor. Continued vigilance regarding financial data integrity is essential while this vulnerability remains unpatched.