CVE-2026-116060: SourceCodester Performance Indicator System adddealer.php sql injection
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and does not require privileges or user interaction according to the supplied severity vector. An attacker would need to send a request that manipulates the Contact argument handled by /opils/staff/adddealer.php.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What security impact could successful exploitation have?
The supplied severity vector indicates low impact to confidentiality, integrity, and availability. Because the flaw is SQL injection, successful exploitation may allow unauthorized database operations within the application's database permissions.