CVE-2026-108964: SourceCodester Performance Indicator System addproduct.php sql injection
A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector.
Which deployments should be prioritized for investigation?
Prioritize instances of SourceCodester Performance Indicator System 1.0 that expose the /opils/admin/addproduct.php endpoint, particularly where the prodcategory argument can be reached remotely.
Is public exploit information available?
Yes. The exploit has been made public and could be used, increasing the likelihood of opportunistic exploitation.