This vulnerability affects SourceCodester Pharmacy Product Management System 1.0 and arises from improper handling of the POST parameter txtqty in the add-sales.php file. Manipulating this parameter leads to business logic errors, which could disrupt normal sales processing. The vulnerability can be exploited remotely without user interaction or elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and low privileges required. No vendor advisory or patch information is provided, and the vulnerability state is published with no remediation level specified.

The impact is limited to business logic errors caused by manipulation of the quantity parameter in sales processing. This could lead to incorrect sales data or transaction inconsistencies within the affected system. There is no indication of direct code execution, data disclosure, or system compromise from the provided data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor for vendor updates. Until a patch is available, consider restricting access to the affected component and validating input parameters to mitigate manipulation risks.