Performance Indicator System CVE-2026-116060

The condition is sending a manipulated 'Contact' argument to the specific endpoint /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0, which reaches an unsanitized SQL query. The exploit is network-reachable with low complexity. The main limiting factor is scope: this is a single, obscure endpoint in a niche product with very low real-world deployment, and the '/staff/' path strongly suggests the page belongs to a staff/administrative area that may require authentication - if so, valid staff credentials would be a prerequisite despite the vendor's PR:N rating. The available sources do not confirm whether authentication is enforced on this endpoint.

This is a textbook low-to-moderate-priority web application SQL injection, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw with no stated privilege or interaction requirement, but the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact, yielding a modest 6.9 score. Exploitation maturity is E:P (proof-of-concept), consistent with the multi-source intelligence: a public PoC reference exists; it is not verified as working exploit code. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the vuln.today decision label is 'this_month', i.e. routine patch prioritization rather than act_now/emergency. One signal to verify: the affected endpoint path is /opils/staff/adddealer.php, and the 'staff' segment suggests a staff/administrative area that may require authentication, which would contradict the PR:N in the vendor-supplied vector - verify the real authentication requirement with the application, because PR:N vs PR:L materially changes exposure. Overall this reads as a genuine but low-severity bug in a niche product, worth scheduled remediation, not crisis response.

A remote attacker submits a crafted value in the 'Contact' parameter to /opils/staff/adddealer.php, injecting SQL that the application concatenates into a database query. A public PoC reference exists (not verified as working exploit code), lowering the effort to reproduce; given low attack complexity, the attacker could read or alter limited database contents. If the /staff/ endpoint in fact requires a login, the attacker would first need valid or stolen staff credentials.