CVE-2026-108964: SQL Injection in SourceCodester Performance Indicator System

This vulnerability affects SourceCodester Performance Indicator System 1.0 in the /opils/admin/addproduct.php script. By manipulating the prodcategory parameter, an attacker can inject SQL commands remotely without any authentication or user interaction required. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction needed, with low to limited impact on confidentiality, integrity, and availability. Public exploit code exists, increasing the risk of exploitation. No vendor advisory or patch information is provided.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and validate or sanitize input parameters to mitigate injection risks.