The SourceCodester Performance Indicator System employs a contact field within edit_dealer.php that is not properly sanitized, enabling an attacker to inject arbitrary SQL commands. This flaw can be exploited remotely through the HTTP parameter named Contact, leading to unauthorized read, modification, or deletion of database records. The resulting breach poses a threat to data confidentiality, integrity, and availability.

SourceCodester Performance Indicator System version 1.0, particularly the edit_dealer.php file located at /opils/staff/ in the application code.

The vulnerability carries a CVSS score of 6.9, indicating a medium severity level. EPSS data is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can launch the exploit from a remote location by manipulating the Contact argument, and a publicly available proof‑of‑concept has been reported, suggesting that exploitation is feasible without evasion techniques.