CVE-2026-30522

Beschreibung

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create -Loan Plans- with specific penalty rates for overdue payments. While the frontend interface prevents users from entering negative numbers in the -Monthly Overdue Penalty- field, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the penalty_rate.