Description

A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T05:16:32.007Z",
  "pubdate": "2026-10-13T05:16:32.007Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the SourceCodester Performance Indicator System version 1.0. The vulnerability resides within the /opils/staff/sales_history.php script, where improper neutralization of user-supplied input leads to unauthorized database interactions.\nThis flaw allows remote, unauthenticated attackers to manipulate SQL queries by injecting malicious payloads via the ID argument. Successful exploitation grants adversaries the ability to extract sensitive information, bypass authentication mechanisms, or execute arbitrary commands against the underlying database management system.\nGiven that the exploit code is publicly available, the risk of active exploitation is significant. Organizations utilizing this product are exposed to potential data exfiltration and integrity compromise, necessitating immediate remediation efforts to prevent unauthorized access to the application's backend architecture.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in /opils/staff/sales_history.php within the Performance Indicator System 1.0. The root cause is the failure of the application to properly sanitize or parameterize input provided to the ID parameter before concatenating it into a database query string.\nWhen a request is submitted to the affected endpoint, the application processes the ID argument directly within its SQL statement execution. Because the input is not validated, an attacker can append malicious SQL syntax—such as UNION SELECT statements or tautologies—to the legitimate query. This allows the attacker to manipulate the query's logic, enabling unauthorized access to the entire database schema.\nThe attack flow begins when an attacker identifies the vulnerable ID argument in the URL or POST request. By injecting crafted SQL payloads, the attacker forces the application to return data from unintended tables, such as administrative credentials or system configuration settings. In many instances, this vulnerability allows for the execution of time-based or boolean-based blind SQL injection techniques, which can be used to exfiltrate database contents character by character even when direct output is not reflected on the page.\nBecause the /opils/staff/sales_history.php script is accessible to remote users, the attack requires no specific authentication or elevated privileges, significantly increasing the potential attack surface. The exploitation does not require advanced access to the internal network, as it can be triggered directly via standard HTTP requests.\nPost-exploitation impact includes full database compromise, which may lead to the disclosure of PII (Personally Identifiable Information), administrative password hashes, and the ability to modify or delete business-critical records. Furthermore, depending on the database configuration, attackers may be able to leverage database-level vulnerabilities to gain command execution on the host server itself, leading to complete system compromise."
}