EUVD-2026-98280
GHSA-qjgm-wp59-vm62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /opils/staff/edit_quantity.php
-
ExploitInject SQL payload via pqty parameter
-
ExecutionBreak out of backend query
-
ImpactExfiltrate or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to send a request to the specific endpoint /opils/staff/edit_quantity.php with a manipulated 'pqty' parameter in the SourceCodester Performance Indicator System 1.0. The '/staff/' path strongly implies the page sits behind a staff login, which would require valid staff credentials or a session despite the vendor's PR:N rating - this is the primary limiting factor and should be confirmed against the deployment. No user interaction is needed and the attack is remote over HTTP; realistic risk is further bounded by the product's rarity in production environments. |
| Impact | This is a moderate, low-priority issue despite the network attack vector. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) with VulDB's base score of 5.5 reflects only LOW impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which is conservative for a SQL injection (CWE-89) that can typically read or alter database contents. A key conflict exists: the vulnerable endpoint is /opils/staff/edit_quantity.php - the '/staff/' path strongly implies an authenticated staff-only area, yet VulDB rated it PR:N (unauthenticated). This discrepancy should be verified; if authentication is in fact required, real-world exploitability is lower than the network-unauthenticated rating suggests. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation. The E:P (Proof-of-Concept) exploit maturity plus a publicly disclosed POC (GitHub issue) means weaponization is trivial, but the target product is an obscure hobbyist PHP application with negligible enterprise footprint, so this is far more likely to appear in automated vulnerability-scanner noise than in targeted campaigns. |
| Exploit ScenarioDerived | An attacker reaches the application's staff quantity-edit page and submits a crafted value in the 'pqty' parameter that breaks out of the intended SQL query, allowing extraction or manipulation of database records. A public proof-of-concept exists (hubdk01 GitHub issue), so the injection can be reproduced with a standard tool such as sqlmap. If the '/staff/' endpoint requires a login, the attacker must first obtain or already hold staff-level access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated remote attackers can exploit a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0 by manipulating the 'pqty' parameter in the /opils/staff/edit_quantity.php endpoint. A public exploit has been disclosed, but the product's limited production use and the requirement for valid staff credentials (as indicated by the /staff/ path) make this a moderate, low-priority issue. No active exploitation has been confirmed.
RemediationAI
No vendor-released patch is identified at the time of analysis. As a compensating control, ensure that the /opils/staff/ directory and specifically edit_quantity.php are only accessible to authenticated staff and consider restricting access via IP whitelisting or VPN, though this may limit legitimate remote access. Implement input validation and parameterized queries for the 'pqty' parameter to prevent SQL injection; this requires code changes to the PHP application. A web application firewall (WAF) can be deployed with rules to block SQL injection attempts against this endpoint, but false positives may occur. Monitor the vendor's site (https://www.sourcecodester.com/) for updates and check the public exploit link (https://github.com/hubdk01/cve/issues/7) for indicators of compromise. Given the low priority, immediate patching may not be critical, but reducing the attack surface is recommended.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The SourceCodester Performance Indicator System is a PHP-based web application. The vulnerability resides in the file /opils/staff/edit_quantity.php, where the 'pqty' parameter is improperly sanitized before being used in an SQL query, leading to SQL injection (CWE-89). This allows an attacker to alter the query logic, potentially reading sensitive data (high confidentiality impact) or modifying data (low integrity impact). The attack is network-based over HTTP and requires no user interaction, but the endpoint path suggests a staff authentication layer is present, aligning with the assessed privilege requirement of PR:L (authenticated). The CPE string cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:* confirms the affected product, and the exploit is publicly available via a GitHub issue, though no active exploitation has been observed.
Know when Performance Indicator System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
The '/staff/' endpoint path implies authenticated access so PR:L; SQL injection permits full database read (C:H) with limited write (I:L) and no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Performance Indicator System
View allSQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /o
SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator
SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argu
SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prod
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker inject arbitrary SQL through the
SQL injection in SourceCodester Performance Indicator System 1.0 lets remote attackers alter SQL statements executed by
SQL injection in the Contact argument handled by /opils/staff/adddealer.php in SourceCodester Performance Indicator Syst
A vulnerability was found in SourceCodester Performance Indicator System 1.0. Rated medium severity (CVSS 5.4), this vul
SQL injection in SourceCodester Performance Indicator System 1.0 allows low-privilege authenticated attackers to manipul
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker who can authenticate to the admi
Exploit-DB