Description
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Published: 2026-10-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote Data Compromise
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a classic SQL injection in the Category parameter of the /opils/admin/view_product.php file within SourceCodester Performance Indicator System 1.0. Exploiting this flaw can allow an attacker to retrieve, modify, or delete data from the underlying database without authorization, as the application fails to neutralize special characters in SQL queries. The weakness falls under CWE-74 (Improper Neutralization of Data for Use in an Expression) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Affected Systems

The affected system is SourceCodester Performance Indicator System, version 1.0, deployed on web servers that expose the /opils/admin/view_product.php administrative interface.

Risk and Exploitability

The described CVSS score of 5.3 indicates moderate severity. No EPSS value is available, but the advisory notes that the exploit is publicly known, suggesting a realistic chance of exploitation in the absence of mitigation. The vulnerability is not listed in the CISA KEV catalog. Attackers can perform the attack remotely by crafting a malicious HTTP request containing a specially crafted Category value that the server will inject into a database query.

Generated by OpenCVE AI on October 6, 2026 at 18:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the SourceCodester Performance Indicator System to a patched version that resolves the SQL injection in view_product.php.
  • If a vendor patch is not available, modify the Category parameter handling to use parameterized queries or prepared statements, ensuring all input is properly escaped or bound.
  • Apply restrictive firewall rules or authentication controls so that only trusted administrators can access the /opils/admin/view_product.php page, and consider deploying a web application firewall to detect and block SQL injection patterns.

Generated by OpenCVE AI on October 6, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Title SourceCodester Performance Indicator System view_product.php sql injection
First Time appeared Sourcecodester
Sourcecodester performance Indicator System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester performance Indicator System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Performance Indicator System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-06T16:00:18.510Z

Reserved: 2026-10-06T08:26:19.784Z

Link: CVE-2026-105957

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-06T17:17:23.500

Modified: 2026-10-06T19:56:02.200

Link: CVE-2026-105957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T18:15:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')