A SQL injection vulnerability exists in the Category argument of the product.php component of SourceCodester Performance Indicator System 1.0. If exploited, an attacker could inject arbitrary SQL statements, potentially leading to unauthorized disclosure, modification, or deletion of sensitive data stored in the underlying database. The flaw is triggered by a remote attacker who can manipulate the request to the web application.

Affected systems include the SourceCodester Performance Indicator System version 1.0. The vulnerability is tied to the product.php script handling the Category parameter. No other versions or components are listed as affected at this time.

The CVSS base score of 6.9 indicates a medium severity. No EPSS score is available, which means an estimate of exploitation probability cannot be derived from that metric. The vulnerability is not listed in the CISA KEV catalog, but the publicly available exploitation code suggests that attackers could readily target the system. The likely attack vector is remote, as the flaw can be triggered through an HTTP request to the application.