Performance Indicator System CVE-2026-116061

Exploitation requires sending a request to the /opils/staff/edit_dealer.php endpoint of SourceCodester Performance Indicator System 1.0 with attacker-controlled input in the Contact parameter, which is passed into a SQL query without sanitization. The supplied CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed, but the 'staff' path segment suggests the endpoint may normally sit behind a staff/admin login - whether it is truly reachable unauthenticated in a default deployment is not confirmed by the available sources and limits realistic exploitation. The practical footprint is further constrained by the product's obscurity: it is a SourceCodester demonstration/hobby application rather than widely deployed enterprise software.

Signals are mostly consistent and point to a genuine but low-to-moderate issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity SQL injection, but the vulnerable-system impacts are all Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact, yielding a modest 6.9 base score. The exploit-maturity flag E:P (Proof-of-Concept) matches the supplied intelligence: a public PoC reference exists but is not verified as working exploit code. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month,' i.e. routine remediation rather than emergency. One caveat to verify: the affected endpoint is /opils/staff/edit_dealer.php, a staff-area path whose name implies an authenticated administrative context, yet the supplied vector asserts PR:N (unauthenticated) - this authentication assumption should be confirmed with the vendor/source, as it materially changes real-world risk. Overall this reads as a legitimate SQLi in an obscure product, worth patching on a normal cycle, not a high-priority emergency.

A remote attacker sends a crafted request to /opils/staff/edit_dealer.php with a malicious value in the Contact parameter, injecting SQL that the application concatenates into a database query. Because the CVSS vector lists AV:N/AC:L/PR:N/UI:N, the request can in principle be sent remotely without user interaction. A public PoC reference exists (GitHub issue), though it is not verified as working exploit code.