CVE-2026-116061

SourceCodester Performance Indicator System edit_dealer.php sql injection

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

The SourceCodester Performance Indicator System employs a contact field within edit_dealer.php that is not properly sanitized, enabling an attacker to inject arbitrary SQL commands. This flaw can be exploited remotely through the HTTP parameter named Contact, leading to unauthorized read, modification, or deletion of database records. The resulting breach poses a threat to data confidentiality, integrity, and availability.

Affected Systems

SourceCodester Performance Indicator System version 1.0, particularly the edit_dealer.php file located at /opils/staff/ in the application code.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a medium severity level. EPSS data is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can launch the exploit from a remote location by manipulating the Contact argument, and a publicly available proof‑of‑concept has been reported, suggesting that exploitation is feasible without evasion techniques.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Contact SourceCodester support to obtain an official patch or mitigation guidance.
  • If a patch is unavailable, implement strict input validation for the Contact field and replace vulnerable string concatenation with parameterized database queries.
  • Deploy a web application firewall or configure server rules to filter and block typical SQL injection payloads targeting edit_dealer.php.

Generated by OpenCVE AI on October 25, 2026 at 21:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Title SourceCodester Performance Indicator System edit_dealer.php sql injection
First Time appeared Sourcecodester
Sourcecodester performance Indicator System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester performance Indicator System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 8:10 PM
Reserved
Oct 24, 2026, 9:42 PM

View source JSON

Updated
Oct 29, 2026, 8:09 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 6:16 PM
Modified
Oct 29, 2026, 9:17 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:45 PM

JSON