Description

A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T04:17:11.900Z",
  "pubdate": "2026-10-13T04:17:11.900Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SourceCodester Performance Indicator System 1.0. The vulnerability resides within the /opils/admin/addproduct.php file and is triggered via the manipulation of the prodcategory argument.\nThis vulnerability is classified as an injection flaw, which allows an unauthenticated or authenticated remote attacker to execute arbitrary SQL commands against the underlying database. Successful exploitation compromises the integrity, confidentiality, and availability of the system's data.\nBy injecting malicious SQL queries into the application's database layer, an attacker can bypass authentication mechanisms, access sensitive administrative data, modify application records, or potentially achieve full administrative control over the database management system. Given that the exploit code is publicly available, the risk of exploitation is significantly elevated. Organizations utilizing this version of the Performance Indicator System are at high risk of data breaches and unauthorized system access until the flaw is remediated.",
  "technicalDetails": "The vulnerability exists due to improper neutralization of special elements used in an SQL command within the /opils/admin/addproduct.php script of the Performance Indicator System 1.0. The application fails to adequately sanitize or parameterize the input provided through the prodcategory argument before incorporating it into a database query.\nThe root cause is a lack of input validation and the use of dynamic SQL generation, where user-supplied data is concatenated directly into the query string. This allows an attacker to break out of the intended SQL syntax context and append arbitrary malicious SQL commands.\nThe attack flow begins with the attacker crafting a specially formed HTTP request targeting the /opils/admin/addproduct.php endpoint. By injecting SQL meta-characters and keywords into the prodcategory parameter, the attacker influences the execution logic of the backend SQL interpreter. For example, by providing payloads such as ' UNION SELECT ... or other boolean or time-based injection sequences, an attacker can perform unauthorized read/write operations.\nBecause the input is processed directly, the database server treats the malicious input as trusted commands rather than literal data. This enables the attacker to perform several actions: 1) Data Exfiltration: Extracting database schemas, administrative credentials, or PII through UNION-based injection. 2) Data Manipulation: Updating or deleting data within the system tables. 3) Denial of Service: Executing resource-intensive queries that hang or crash the database backend. 4) Authentication Bypass: Modifying authentication logic to allow unauthorized entry.\nThe vulnerability is accessible over the network, allowing remote attackers to initiate the attack without requiring local access to the server. Given the public availability of the exploit, the barrier to entry is minimal, allowing even low-skilled actors to execute successful attacks against exposed instances. The application context, specifically an administrative file, suggests that exploitation targets highly sensitive areas of the software's functional scope."
}