Summary

SourceCodester Card Holder Management System 1.0 fails to validate quantity input in its “Minus Value Handler.” A remote, unauthenticated attacker can submit values the application should reject (such as negative or out-of-range quantities), driving the system into an inconsistent state.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N — 5.3 Medium.

Details

The handler accepts a client supplied quantity without enforcing the expected bounds. There is no check that the value is positive or within a sane range before it is applied. Because the constraint exists only in the UI (or not at all) rather than server side, a crafted request bypasses it. The value manipulated is the account balance field, significantly increasing the business logic impact.

Impact

Limited integrity impact only (no confidentiality or availability loss). Improperly validated quantities can corrupt records and subvert business logic — for example skewing totals or producing negative balances — but do not expose data or take the application offline.

Remediation

  • Validate quantity server-side: enforce type, sign, and an acceptable range before the value is used or stored.
  • Reject (don’t silently coerce) out-of-bounds input, and treat client-side limits as advisory only.

This affects the end-of-life 1.0 release; no vendor patch is available.

Disclosure Timeline

  • 2023-08-20 — Publicly disclosed (VDB-237560 / CVE-2023-4439).

References