The application does not check the values of the "txtprice" and "txttotalcost" fields in add-sales.php, allowing a user to submit negative numbers. This causes the system to record sales transactions with negative amounts, which in turn corrupts sales totals, inventory accounting, and revenue reports. The vulnerability is a business‑logic flaw that can lead to a monetary loss for the business and defeat the integrity of financial data.

The flaw exists in the SourceCodester Pharmacy Product Management System version 1.0. Any deployment of this product that uses the add‑sales module is vulnerable, as the system can accept unvalidated input when performing sales entries.

The CVSS base score of 7.5 indicates a high‑severity vulnerability, while the EPSS score of less than 1% implies the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires access to the add‑sales form, which is typically available to authenticated staff users; hence the attack vector is application‑layer input manipulation. An attacker can submit crafted form data with negative prices and costs, leading to incorrect financial calculations and potential fraud.