CVE-2026-108967: SourceCodester Performance Indicator System edit_credit.php sql injection
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/editcredit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction according to the supplied CVSS vector. An attacker would need to be able to send a request to the affected edit_credit.php endpoint and control its credit argument.
How likely is exploitation in the near term?
A public exploit has been released, and the vulnerability is rated as having proof-of-concept exploit maturity. This increases the practical risk for internet-reachable deployments.
What should be prioritized if an immediate fix is unavailable?
Prioritize restricting remote access to /opils/staff/edit_credit.php, especially from untrusted networks, because the attack is remote and targets the credit parameter. Monitor requests to that endpoint for suspicious or malformed credit values.