A business logic flaw in SourceCodester Loan Management System version 1.0 permits authenticated administrators to submit negative values for the interest_percentage field. The client‑side interface blocks negative entries, but the server does not enforce this rule, enabling an attacker to craft an HTTP POST request with a negative interest rate. This results in loan plans that effectively pay the borrower rather than charging interest, potentially causing direct financial loss or undermining the system’s economic model.

The vulnerability affects the SourceCodester Loan Management System, specifically the Loan Plan creation module in version 1.0. No other vendors or products were identified in the CNA data.

The flaw is limited to users who can authenticate with administrative privileges, so an attacker must first compromise or obtain valid credentials. No CVSS score, EPSS score, or KEV listing is available, but the financial implications are significant, as negative interest rates can erase loan repayments or generate fraudulent profit. With an approved authentication vector, the exploitation is straightforward: submit a signed POST request containing a negative interest_percentage and the system will accept and store the plan. The lack of server‑side validation makes this straightforward and time‑invariant, indicating a high exploitable risk for any organization still running this unpatched software.