A critical business logic vulnerability in the SourceCodester Pharmacy Product Management System permits unauthorized inventory manipulation, posing a significant risk to operational integrity.

The application fails to validate the requested sales quantity in the add-sales.php file against current inventory levels. This flaw allows an unauthenticated attacker to complete transactions for quantities exceeding available stock.

The ability to manipulate sales quantities directly impacts financial reporting and physical inventory accuracy. With a CVSS score of 7.5, this vulnerability presents a high risk for potential revenue loss and system-wide data corruption. Organizations relying on this system could face significant operational disruptions and reconciliation challenges if inventory states are maliciously altered.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the Pharmacy Product Management System to authorized personnel only via network-level controls.

Proactive Monitoring: Review application logs for anomalous sales volume entries or transactions that exceed known stock levels to identify potential exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests to add-sales.php that contain suspicious or non-standard quantity values in the txtqty parameter.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability requires immediate attention. Security teams should prioritize isolating the affected application from public-facing segments of the network until a formal fix is released by the developer.