Description
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Data Compromise
Action: Immediate Patch
AI Analysis

Impact

An SQL injection flaw exists in an unknown function of sales_history.php in SourceCodester Performance Indicator System 1.0. The flaw is triggered by manipulating the ID argument, allowing attackers to inject arbitrary SQL. Successful exploitation can disclose, modify, or delete data stored in the application's database, potentially compromising sensitive business information and undermining data integrity.

Affected Systems

The affected product is the SourceCodester Performance Indicator System, version 1.0, particularly the sales_history.php component accessed via the web interface. No additional affected versions are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible and a public exploit reference exists, meaning attackers can issue crafted requests over the internet to leverage the injection. No special conditions are required beyond access to the web application.

Generated by OpenCVE AI on October 13, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a version of Performance Indicator System that removes the vulnerable code.
  • If an immediate patch is unavailable, restrict inbound traffic to the web server and configure a web application firewall to filter SQL injection patterns targeting the ID parameter.
  • Review and refactor the sales_history.php function to use parameterized queries and validate all input before any database operation.

Generated by OpenCVE AI on October 13, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Performance Indicator System sales_history.php sql injection
First Time appeared Sourcecodester
Sourcecodester performance Indicator System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester performance Indicator System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Performance Indicator System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:13:23.778Z

Reserved: 2026-10-11T19:39:34.734Z

Link: CVE-2026-108968

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:23.627Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T05:16:32.007

Modified: 2026-10-15T16:17:42.567

Link: CVE-2026-108968

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T06:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')