An input‑validation flaw in SourceCodester Pharmacy Product Management System 1.0, specifically in add‑stock.php, allows the txtqty parameter to be set to negative values. Rather than increasing the inventory level, the system decreases it, corrupting stock records and potentially depleting product quantities entirely, which can block pharmacy operations. The weakness is a classic business‑logic bypass and aligns with CWE‑20 (Improper Input Validation).

SourceCodester Pharmacy Product Management System, version 1.0, the add‑stock.php module is affected. No other vendors or product versions are reported.

The vulnerability can be exploited by any user who can reach the add‑stock endpoint; it is inferred that authentication is required but not enforced. The CVSS score of 7.5 indicates high severity. EPSS data are not available, so exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The lack of input validation means an attacker could repeatedly inject negative quantities to drain inventory, leading to operational disruption.