A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation. The application allows administrators to define "Loan Plans" which determine the duration of a loan (in months). However, the backend fails to validate that the duration must be a positive integer. An attacker can submit a negative value for the months parameter. The system accepts this invalid data and creates a loan plan with a negative duration.
References
| Link | Resource |
|---|---|
| https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/BusinessLogic-LoanPlan-NegativeMonths.md | Exploit Third Party Advisory |
Configurations
History
07 Apr 2026, 12:03
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:oretnom23:loan_management_system:1.0:*:*:*:*:*:*:* | |
| References | () https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/BusinessLogic-LoanPlan-NegativeMonths.md - Exploit, Third Party Advisory | |
| First Time |
Oretnom23 loan Management System
Oretnom23 |
01 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
01 Apr 2026, 15:22
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 15:22
Updated : 2026-04-07 12:03
NVD link : CVE-2026-30523
Mitre link : CVE-2026-30523
CVE.ORG link : CVE-2026-30523
JSON object : View
Products Affected
oretnom23
- loan_management_system
CWE
CWE-20
Improper Input Validation