A business logic flaw in the SourceCodester Loan Management System permits an authenticated administrator to set a negative monthly overdue penalty when creating loan plans, because the backend does not enforce server‑side validation. The front‑end interface mistakenly blocks negative input, but an attacker can bypass this by forging the HTTP POST request. This enables borrowers to receive a reduced or even negative penalty, creating a financial advantage for the attacker and a monetary loss for the institution. The vulnerability is identified as CWE-602, reflecting unvalidated dependency logic.

SourceCodester Loan Management System version 1.0 is the only product named in the CNA data. No other vendors or product versions are indicated.

The CVSS base score of 6.5 indicates moderate severity. Exploitation requires administrative credentials and the ability to submit crafted requests, while no EPSS data or KEV listing is available. Consequently, the probability of exploitation is uncertain, but the potential financial impact is clear once the flaw is leveraged. Administrators should monitor changes to loan plans and enforce server-side checks promptly.