Performance Indicator System CVE-2026-108967

Exploitation requires the attacker to reach the /opils/staff/edit_credit.php endpoint of a deployed SourceCodester Performance Indicator System 1.0 instance and submit a manipulated 'credit' request argument; no user interaction is needed. The supplied CVSS vector states PR:N (no privileges), but the file's location under the /staff/ administrative directory suggests a staff session may in practice be required - defenders should confirm whether this endpoint is authenticated in their deployment, as that is the primary limiting factor. The main real-world limiter is deployment scarcity: this is a niche application rarely exposed on production networks.

Signals are mixed but point to a genuine-but-low-priority issue. The CVSS 4.0 base score is 6.9 (MEDIUM) with AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no auth or interaction stated) but only partial impact across all three dimensions (VC:L/VI:L/VA:L), which is why the score stays medium rather than critical. The vector carries E:P (Proof-of-Concept), consistent with the publicly released exploit on GitHub. There is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of active or widespread exploitation - exploitation status is 'publicly available exploit code exists,' which must not be conflated with in-the-wild use. One notable tension: the vulnerable file sits under /opils/staff/, implying a staff/administrative area that would normally require authentication, yet the supplied CVSS vector asserts PR:N - this inconsistency should be verified against the actual code, as SourceCodester demo applications frequently ship with absent or trivially bypassed authentication. Net: a real, confirmed SQL injection with public PoC, but the medium severity, partial impact, obscure product, and absence of KEV/EPSS data make this a low real-world priority outside of anyone actually running this specific application.

A remote attacker sends a crafted HTTP request to /opils/staff/edit_credit.php with a malicious value in the 'credit' parameter, injecting SQL into the backend query. A public proof-of-concept exists (GitHub issue linked from VulDB), lowering the skill needed to reproduce it. Given AC:L and the partial CVSS impact, the attacker could read or alter limited database records or cause minor disruption.