Technical impact
The vulnerability is an SQL injection flaw located in the Contact parameter handling of the file /opils/staff/save_profile.php within SourceCodester Performance Indicator System 1.0. When an attacker supplies crafted input, the unfiltered value is passed directly to a database query, allowing arbitrary SQL commands to be executed. The main consequence is that an attacker can read, modify, or delete data, potentially gaining full control over the underlying database. This vulnerability falls under CWE-74 and CWE-89, representing improper input handling leading to injection.
Affected Systems
The affected product is SourceCodester Performance Indicator System version 1.0. No other product versions have been identified as vulnerable in the current advisory. The vulnerability resides on the server side and can be triggered via HTTP requests to the save_profile.php script, meaning any user with access to the web interface can invoke it.
Risk and Exploitability
The CVSS score of 6.9 indicates a medium severity. The EPSS score is not available, so current exploitation probability cannot be quantified, but the advisory states that exploitation code has been publicly released, signifying that the attack can be executed from a remote location without requiring local privileges. The vulnerability is not listed in the CISA KEV catalog, but the existence of a public exploit suggests it is already in the wild. Attackers would need to craft a SQL payload in the Contact field, submit it through the web interface, and the resulting database manipulation could lead to data exfiltration or compromise of the entire system.
