A flaw in SourceCodester Performance Indicator System 1.0 allows an attacker to manipulate the Contact argument within /opils/staff/adddealer.php, enabling arbitrary SQL commands to be executed on the underlying database. This can expose sensitive data, alter records, or cause unauthorized data deletion, compromising confidentiality and integrity. The vulnerability is a classic string concatenation weakness identified by CWE-74 and CWE-89.

The affected product is the SourceCodester Performance Indicator System, version 1.0. The specific code path impacted is the adddealer.php script located under /opils/staff/; no additional versions or modules are listed in the available data.

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that it may not have widely known exploits yet. However, the description notes that the attack can be launched remotely and that the exploit has been publicly disclosed, implying that an attacker could craft a malicious request from outside the network. The lack of additional exploitation conditions means that a reachable adddealer.php endpoint is sufficient for exploitation.