Description

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T04:17:13.777Z",
  "pubdate": "2026-10-13T04:17:13.777Z",
  "executiveSummary": "The Performance Indicator System version 1.0 is affected by a critical SQL injection vulnerability residing within the /opils/staff/edit_quantity.php file.\nThe vulnerability allows remote, unauthenticated, or authenticated attackers to manipulate input passed to the 'pqty' argument, enabling the execution of arbitrary SQL commands against the underlying database.\nSuccessful exploitation of this flaw can result in unauthorized data exfiltration, modification of database contents, bypass of authentication mechanisms, or complete compromise of the application's data layer.\nThe vulnerability is currently public, significantly increasing the risk of exploitation by malicious actors.\nThis SQL injection poses a severe threat to the integrity, confidentiality, and availability of the system.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the 'edit_quantity.php' script.\nThe application fails to perform adequate input validation or sanitization on the 'pqty' argument before incorporating it into dynamic SQL queries.\nAn attacker can exploit this vulnerability by injecting crafted SQL payloads into the 'pqty' parameter during the edit quantity process.\nBecause the input is not parameterized, the application directly interprets the injected characters as part of the SQL command, allowing the attacker to alter the query's logic.\nThe attack flow begins with the attacker identifying the target endpoint /opils/staff/edit_quantity.php. The attacker then crafts a malicious HTTP request (typically POST or GET depending on implementation) containing a manipulated 'pqty' value. This value might include SQL syntax such as UNION SELECT, SLEEP(), or stacked queries.\nWhen the server-side code executes the flawed query, the database management system (DBMS) interprets the malicious payload. If the query execution is successful, the attacker can extract data from the database, dump tables, or, depending on database configuration and permissions, perform write operations or execute administrative commands.\nThis vulnerability is classified as a remote attack, meaning it does not require physical access to the server, and the impact is limited only by the privileges assigned to the database user account used by the application.\nThe lack of prepared statements or parameterized queries is the primary architectural failure in the vulnerable component, permitting arbitrary SQL command execution."
}