A business logic vulnerability in the SourceCodester Pharmacy Product Management System allows unauthenticated attackers to manipulate financial records and inventory values.

The application fails to validate the txtprice and txttotalcost parameters within the add-stock.php file, allowing an unauthenticated user to submit negative values. This bypasses financial input controls and results in the corruption of procurement costs and inventory asset records.

Successful exploitation of this vulnerability allows for the deliberate manipulation of financial data and inventory valuation within the pharmacy management system. Given the CVSS score of 7.5, this high severity flaw poses significant risks to the integrity of business operations and financial reporting, potentially leading to unauthorized inventory adjustments or fraudulent procurement tracking.

Immediate Action: As no official patch is currently available, administrators should restrict access to the add-stock.php endpoint to authorized internal personnel only.

Proactive Monitoring: Review application logs for unusual transaction entries, specifically searching for negative numeric inputs submitted to the stock management module.

Compensating Controls: Implement input validation rules at the Web Application Firewall level to block requests containing negative values in price or cost parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up on GitHub.

Due to the lack of an official vendor patch, organizations utilizing the Pharmacy Product Management System must treat this as a high risk to data integrity. Immediate steps should be taken to isolate the vulnerable component and implement strict input validation controls to prevent unauthorized financial manipulation until a formal security update is released.