The vulnerability is a business logic flaw in the SourceCodester Pharmacy Product Management System where the add-sales.php script does not verify that the quantity requested by the customer does not exceed the stock available. This allows an attacker to alter the txtqty parameter in a request and purchase far more units than exist, resulting in inventory shortfall, potential financial loss and customer dissatisfaction. The flaw is a direct application of Business Logic Error (CWE-841).

The flaw affects the SourceCodester Pharmacy Product Management System, version 1.0. As described, the product name is Web-based Pharmacy Product Management System. The CPE indicates version 1.0, so any instance deploying this exact build is vulnerable unless patched.

The CVSS score of 7.5 places the vulnerability in the high severity range. However, the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote, achievable through manipulation of the HTTP request to add-sales.php by any user who can submit a sales form. The impact could be significant for businesses relying on accurate inventory counts and revenue reporting.