Description
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection in addproduct.php allows remote attackers to execute arbitrary SQL statements
Action: Assess Impact
AI Analysis

Impact

A flaw in SourceCodester Performance Indicator System 1.0 permits an attacker to manipulate the prodcategory argument of /opils/admin/addproduct.php, resulting in a classic SQL injection. The vulnerability falls under CWE-74 and CWE-89 and is rated with a CVSS score of 6.9, indicating moderate severity and that the flaw can be exploited remotely.

Affected Systems

Any deployment of SourceCodester Performance Indicator System version 1.0 is susceptible, specifically the addproduct.php component handling product category input. The product’s public release information identifies the version, but the exact file path is unknown beyond the documented /opils/admin/addproduct.php location.

Risk and Exploitability

The exploit is publicly available and can be initiated from a remote location, though no EPSS score is available. The weakness is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the vulnerability can be exploited remotely, but the likelihood of exploitation is not quantified in the provided data.

Generated by OpenCVE AI on October 13, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check SourceCodester’s website or support channels for a patch that addresses the addproduct.php SQL injection flaw.
  • Restrict access to the /opils/admin/addproduct.php endpoint to trusted IP ranges and enforce strong authentication before allowing any requests to this path.
  • Implement server‑side input validation or use prepared statements to ensure the prodcategory parameter cannot inject SQL code.

Generated by OpenCVE AI on October 13, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Title SourceCodester Performance Indicator System addproduct.php sql injection
First Time appeared Sourcecodester
Sourcecodester performance Indicator System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester performance Indicator System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Performance Indicator System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:13:30.958Z

Reserved: 2026-10-11T19:39:19.304Z

Link: CVE-2026-108964

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:24.931Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T04:17:11.900

Modified: 2026-10-15T16:17:42.373

Link: CVE-2026-108964

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T06:00:15Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')