{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/performance-indicator-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:performance_indicator_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108964"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Performance Indicator System (1.0)"],"_cs_severities":["high"],"_cs_tags":["sqli","web-vulnerability","injection","sql-injection","sourcecodester","web-application-security","cve"],"_cs_type":"advisory","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eSourceCodester Performance Indicator System version 1.0 is affected by a SQL injection vulnerability identified as CVE-2026-108964. The vulnerability exists within the file /opils/admin/addproduct.php and specifically impacts the 'prodcategory' argument. An unauthenticated remote attacker can supply maliciously crafted input to this parameter to manipulate database queries. This flaw arises from improper neutralization of special elements used in an SQL command before passing the input to the database management system. Publicly available exploit code increases the risk of successful exploitation by unauthorized actors attempting to gain unauthorized access to or extract data from the application database.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to interact directly with the backend database. This may lead to the unauthorized disclosure, modification, or deletion of sensitive information stored within the application, such as user credentials, system configuration details, or internal performance data. Given the administrative context of the vulnerable script, the impact may extend to full database compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReview application logs for HTTP POST requests to /opils/admin/addproduct.php that contain SQL syntax characters in the 'prodcategory' parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and parameterization for all user-supplied data in the Performance Indicator System codebase to prevent SQL injection.\u003c/li\u003e\n\u003cli\u003eRestrict access to the /opils/admin/ directory to authenticated administrators only, if business requirements permit.\u003c/li\u003e\n\u003cli\u003eConsult the vendor or the source software provider for patches addressing CVE-2026-108964 in version 1.0.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-13T06:33:13Z","date_published":"2026-10-13T04:32:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-performance-indicator-system-sqli/","summary":"SourceCodester Performance Indicator System 1.0 contains an unauthenticated SQL injection vulnerability via the prodcategory parameter, allowing remote attackers to execute arbitrary SQL queries.","title":"SQL Injection in SourceCodester Performance Indicator System","url":"https://feed.craftedsignal.io/briefs/2026-10-performance-indicator-system-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Performance Indicator System (1.0)","version":"https://jsonfeed.org/version/1.1"}