Performance Indicator System CVE-2026-108968

Exploitation requires reaching the staff sales-history feature at /opils/staff/sales_history.php and supplying a manipulated ID parameter in the request; the flaw is specific to this endpoint's handling of that argument. Per the provided CVSS vector (PR:N/UI:N) no privileges or user interaction are claimed, enabling scripted remote attacks against affected SourceCodester Performance Indicator System 1.0 instances. However, the /staff/ location strongly implies a staff-authenticated area, so a valid staff session may be a practical prerequisite that limits exploitation; this is not resolved by the available data. The product's rare deployment is itself the main limiting factor on real-world exposure.

This is a high-CVSS-potential but low-real-world-priority issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation, but the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L), producing a modest base score of 5.5 - consistent with a scoped SQL injection that leaks or alters limited data rather than yielding full database compromise. A public exploit exists (VulDB, GitHub PoC), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. Note a conflict worth verifying: the CVSS vector asserts PR:N (unauthenticated), yet the vulnerable endpoint resides under a /staff/ path (/opils/staff/sales_history.php), which typically implies an authenticated staff area - if a login is actually required, real-world risk is lower than PR:N suggests; verify with the product/source. Overall, the combination of a niche hobby-grade product, low technical impact, and no confirmed exploitation makes this a low-urgency item despite the public PoC.

A remote attacker sends a crafted HTTP request to /opils/staff/sales_history.php with a malicious ID parameter, injecting SQL to read or tamper with limited database records. A public proof-of-concept is available (GitHub issue referenced by VulDB), lowering the skill barrier; given AV:N/AC:L the request can be automated against any reachable instance, though the /staff/ path may require a valid session first.