CVE-2026-105957: SQL Injection in SourceCodester Performance Indicator System

The vulnerability CVE-2026-105957 affects SourceCodester Performance Indicator System 1.0. It is an SQL injection issue caused by improper sanitization of the 'Category' parameter in the /opils/admin/view_product.php script. An attacker with low privileges can remotely exploit this flaw without user interaction to inject SQL commands. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, and no privileges required. Public exploit code has been published, but no known active exploitation in the wild has been reported.

Successful exploitation allows an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires low privileges and no user interaction, making remote exploitation feasible. However, the overall impact is limited by the low scope and low integrity and availability impact metrics in the CVSS vector.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected script and validate or sanitize input parameters to mitigate SQL injection risks.