The vulnerability is a SQL injection in the SourceCodester Performance Indicator System 1.0, specifically in the edit_credit.php script. An attacker can manipulate the credit argument to inject arbitrary SQL statements, allowing unauthorized data retrieval, modification, or deletion. This directly compromises the confidentiality and integrity of the system’s database. The flaw maps to CWE‑74 for improper query construction and CWE‑89 for SQL injection.

The affected product is SourceCodester Performance Indicator System version 1.0, which is also indicated by the vendor/product CPE string. No other versions or products are listed as affected.

The CVSS score of 6.9 reflects a moderate risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. A publicly released exploit indicates that the attack can be launched remotely, likely through crafted HTTP requests to the credit parameter. Because no official patch or workaround is provided, the likelihood of exploitation depends on the attacker’s ability to deliver the crafted request; nevertheless, the existence of a public exploit suggests a realistic threat.