Description
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in the file /opils/staff/edit_quantity.php of SourceCodester Performance Indicator System 1.0. The argument pqty is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This vulnerability is a classic SQL injection (CWE-89) and is triggered by malformed input (CWE-74). A successful exploit could let an unauthenticated remote user read, modify, or delete data in the underlying database, potentially compromising confidentiality, integrity, and availability.

Affected Systems

The affected product is SourceCodester Performance Indicator System version 1.0. No other versions or products are listed, and the vulnerability resides specifically in the edit_quantity.php script.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. EPSS is not available, and the vulnerability is not included in the CISA KEV list. The attack vector is remote via direct manipulation of the pqty parameter in a web request, and the exploit has been publicly disclosed. Due to these factors, the risk of exploitation remains significant in environments that expose the affected script without mitigation.

Generated by OpenCVE AI on October 13, 2026 at 05:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the SourceCodester Performance Indicator System to the latest version or apply any vendor-supplied patch that addresses the SQL injection in edit_quantity.php.
  • Implement input validation and use parameterized queries or stored procedures to sanitize the pqty argument, eliminating the ability to inject SQL commands.
  • Deploy a web application firewall or configure the web server to block suspicious requests that attempt SQL injection patterns against the pqty parameter.

Generated by OpenCVE AI on October 13, 2026 at 05:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Performance Indicator System edit_quantity.php sql injection
First Time appeared Sourcecodester
Sourcecodester performance Indicator System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester performance Indicator System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Performance Indicator System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T04:00:16.345Z

Reserved: 2026-10-11T19:39:23.324Z

Link: CVE-2026-108965

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T04:17:13.777

Modified: 2026-10-13T04:17:13.777

Link: CVE-2026-108965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T05:30:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')