PT-2026-29533 · Sourcecodester · Alton Management System

Meifukun · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-30523

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Loan Management System version 1.0

Description A business logic flaw exists because the application does not properly validate input. Specifically, the system allows administrators to define 'Loan Plans' with a duration in months, but it does not verify that the duration is a positive integer. An attacker can submit a negative value for the months parameter, and the system will accept this invalid data, creating a loan plan with a negative duration.

Recommendations Ensure that the duration value for loan plans is validated to be a positive integer.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-30523

Affected Products

Alton Management System

References · 3

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Loan-Management-System/BusinessLogic-LoanPlan-NegativeMonths.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30523 · Security Note
• https://twitter.com/CVEnew/status/2039372081754751361 · Twitter Post