The system allows administrators to configure loan plans solely by specifying a duration in months, but the backend omits validation that this value must be a positive integer. An attacker who can submit an administrative request can send a negative months value; the system stores this invalid plan and accepts it as a legitimate loan schedule. Because the loan duration can become negative, it may effectively grant a loan that never matures or otherwise distort financial reporting and risk exposure, constituting an exploitable business logic error.

The SourceCodester Loan Management System, version 1.0, is vulnerable. No other vendor or product versions are mentioned, and the vulnerability is specific to this application stack.

With a CVSS score of 6.5, the flaw is considered moderate in severity. The EPSS score is below 1 %, indicating that widespread exploitation is unlikely at present, and the vulnerability is not yet listed in CISA's KEV catalog. Because the flaw requires an administrative context to create a loan plan, the attack vector is likely “local” or “authenticated” rather than remote. An attacker who can force the months parameter to a negative number can create loan plans that may never expire or otherwise misrepresent loan terms, potentially enabling financial abuse. No publicly disclosed exploits exist, but the low exploitation probability does not eliminate the need to address the underlying input validation bug.