Performance Indicator System CVE-2026-108964

Exploitation requires reaching the administrative endpoint /opils/admin/addproduct.php and supplying a malicious value in the 'prodcategory' request parameter, which is passed unsanitized into a SQL query. The VulDB vector marks it remotely exploitable with no user interaction and PR:N, but because this is an /admin/ script, realistic exploitation likely presupposes access to the admin interface (either a valid admin session or a product-add page that lacks a session check) - this authentication requirement is the key limiting factor and is not confirmed in the input. No special non-default configuration is otherwise named; the affected version is fixed at Performance Indicator System 1.0.

Signals are mixed and point to a moderate, opportunistic risk rather than an urgent priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with only Low impacts to confidentiality, integrity and availability yields a 6.9 (Medium), and the exploit maturity is explicitly E:P (proof-of-concept), consistent with the public POC. This is NOT in CISA KEV - no evidence of active exploitation - so the correct status is 'publicly available exploit code exists', which must not be conflated with in-the-wild use. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The most important caveat: the vulnerable file is /opils/admin/addproduct.php, an administrative endpoint, yet the vendor (VulDB) vector asserts PR:N (unauthenticated). This is a conflict - an admin-area script normally implies some authentication, and VulDB routinely over-rates SourceCodester admin pages as PR:N; verify whether addproduct.php enforces a session check before treating this as unauthenticated. Overall this reads as a real but low-urgency, low-prevalence (hobby PHP project) SQLi with a public PoC, not a high-real-risk flaw.

An attacker reaches the admin product-add page and submits a crafted value in the 'prodcategory' parameter of /opils/admin/addproduct.php, injecting SQL that the backend executes against the application database. A public proof-of-concept exists (linked GitHub issue), lowering the skill needed to reproduce it; a successful injection can read, alter, or in some configurations enumerate database contents. Whether this requires a prior admin login depends on whether the endpoint enforces authentication, which is not confirmed in the input.