SQL Injection in SourceCodester Performance Indicator System

SourceCodester Performance Indicator System version 1.0 is affected by a SQL injection vulnerability identified as CVE-2026-108964. The vulnerability exists within the file /opils/admin/addproduct.php and specifically impacts the 'prodcategory' argument. An unauthenticated remote attacker can supply maliciously crafted input to this parameter to manipulate database queries. This flaw arises from improper neutralization of special elements used in an SQL command before passing the input to the database management system. Publicly available exploit code increases the risk of successful exploitation by unauthorized actors attempting to gain unauthorized access to or extract data from the application database.

Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database. This may lead to the unauthorized disclosure, modification, or deletion of sensitive information stored within the application, such as user credentials, system configuration details, or internal performance data. Given the administrative context of the vulnerable script, the impact may extend to full database compromise.

Recommendation

1. Review application logs for HTTP POST requests to /opils/admin/addproduct.php that contain SQL syntax characters in the 'prodcategory' parameter.
2. Implement strict input validation and parameterization for all user-supplied data in the Performance Indicator System codebase to prevent SQL injection.
3. Restrict access to the /opils/admin/ directory to authenticated administrators only, if business requirements permit.
4. Consult the vendor or the source software provider for patches addressing CVE-2026-108964 in version 1.0.