Performance Indicator System CVE-2026-108966

Exploitation requires reaching the /opils/staff/product.php endpoint of SourceCodester Performance Indicator System 1.0 and supplying a malicious value in the 'Category' request argument, which is passed unsanitized into a SQL query. The supplied CVSS vector marks PR:N (no privileges), but the 'staff' location of the script suggests the page may sit behind a staff authentication/back-office area; if so, valid staff access would be a limiting prerequisite - this should be confirmed against the deployment. Practical limits on real-world risk are the product's rare deployment footprint and the Low-rated data impact; no user interaction is required and attack complexity is low.

Signals are mixed and lean toward low real-world priority despite a medium CVSS 4.0 base score of 6.9. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, but all impact metrics are only Low (VC:L/VI:L/VA:L) and scope is unchanged (SC:N/SI:N/SA:N), which keeps the score moderate rather than critical. The exploit-maturity metric is E:P (Proof-of-Concept), consistent with the reported public PoC. There is no EPSS score and no SSVC decision data in the input, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only a publicly available PoC, which is a distinct and weaker signal. A notable conflict: the CVSS vector asserts PR:N (unauthenticated), yet the affected endpoint path /opils/staff/product.php strongly implies a staff/back-office area that would normally require authentication - this discrepancy should be verified, as it materially changes exploitability. Net assessment: a genuine SQL injection with a working PoC, but in a niche hobby/demo-grade product with limited deployment and only Low impact ratings, making it a low operational priority for most defenders absent evidence that the specific application is in use.

A remote attacker sends a crafted request to /opils/staff/product.php with a malicious value in the Category parameter, injecting SQL that the backend executes against the application database. Because a public proof-of-concept exists (referenced at the GitHub issue) and attack complexity is low, the payload can be reproduced directly to read or tamper with database contents. If the staff endpoint is in fact gated by a login, the attacker would first need valid or obtained staff credentials.