CVE-2026-116055: SourceCodester Performance Indicator System deleteproduct.php sql injection
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is able to exploit this issue?
An attacker must have privileges to access the administrative deleteproduct.php functionality, as reflected by the low-privileges-required rating. The attack can be performed remotely and does not require user interaction.
What is required for exploitation?
Exploitation involves manipulating the ID argument handled by /opils/admin/deleteproduct.php to inject SQL. Public exploit information is available, increasing the likelihood of attempted exploitation.
How can I determine whether my deployment is affected?
The reported affected product version is SourceCodester Performance Indicator System 1.0. Review access and request logs for requests to /opils/admin/deleteproduct.php with unusual or malformed ID parameter values.