A business logic flaw in the add‑stock.php module of Web‑Based Pharmacy Product Management System version 1.0 allows the application to accept negative values for the txtprice and txttotalcost fields without validation. The unchecked negative numbers corrupt financial records, enabling an attacker to artificially lower inventory asset values and procurement costs, thereby skewing reported financial statements and potentially stealing value from the organization. This weakness maps to CWE‑20 (Input Validation).

The vulnerability exists in SourceCodester Pharmacy Product Management System 1.0, a PHP‑based web application that manages pharmacy inventory. No specific vendor is listed in the CNA data, but the application is identified by the CPE string for senior‑walter:web‑based_pharmacy_product_management_system 1.0.

With a CVSS score of 7.5 the risk level is medium‑high. The EPSS score of less than 1% indicates a low likelihood that existing exploit code is available in the wild. The vulnerability is not in the CISA KEV catalog. The most likely attack vector is via the web interface that handles stock entries, and it probably requires administrative privileges to access add‑stock.php. Once accessed, an attacker can submit negative numeric values to corrupt the system’s financial data.