CVE-2026-105957: SourceCodester Performance Indicator System view_product.php sql injection
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/viewproduct.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it over the network, but the CVSS vector indicates low privileges are required. No user interaction is required.
What input is affected?
The SQL injection is triggered by manipulating the Category argument handled by /opils/admin/view_product.php.
How likely is exploitation?
The exploit is public, and the attack complexity is rated low. This makes systems reachable by a low-privileged attacker a practical concern.
What is the potential impact?
The reported severity is medium, with low impacts to confidentiality, integrity, and availability. Successful exploitation may affect all three of these areas to a limited extent.