CVE-2026-108968: SourceCodester Performance Indicator System sales_history.php sql injection
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/saleshistory.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires no privileges or user interaction. An attacker can target the affected sales_history.php endpoint over the network by manipulating the ID argument.
Is there public exploit availability?
Yes. Exploit code or exploit details have been made publicly available, increasing the likelihood of attempted attacks.
Which deployments should be prioritized for investigation?
Prioritize SourceCodester Performance Indicator System 1.0 instances that expose /opils/staff/sales_history.php to remote users. The available data does not state whether authentication or particular default settings restrict access to this endpoint.
What is the potential impact if exploitation succeeds?
The reported severity vector indicates potential low impact to confidentiality, integrity, and availability. The issue is classified as SQL injection, but the provided data does not specify what database data or application functions may be reachable.