SourceCodester PIS 1.0: Four SQLi Flaws Disclosed Together, Exploits Publicly Available
Four SQL injection vulnerabilities in SourceCodester Performance Indicator System 1.0 were disclosed on October 25, 2026, with publicly available exploits posing an immediate risk.
Key findings
- Four SQL injection vulnerabilities disclosed for SourceCodester Performance Indicator System 1.0 on October 25, 2026.
- Three High severity (CVSSv3 7.3) and one Medium severity (CVSSv3 6.3) flaws were patched.
- Vulnerabilities affect staff profile, dealer management, and product deletion functionalities.
- Exploits for all four CVEs are publicly available, increasing risk.
On October 25, 2026, a batch of four vulnerabilities was disclosed for SourceCodester Performance Indicator System 1.0. The vulnerabilities, disclosed within a three-hour window, primarily involve SQL injection flaws, with three rated as High severity and one as Medium. The public availability of exploits for these issues raises immediate concerns for users of the system.
Three of the vulnerabilities, CVE-2026-116062, CVE-2026-116061, and CVE-2026-116060, stem from SQL injection flaws in the /opils/staff/save_profile.php, /opils/staff/edit_dealer.php, and /opils/staff/adddealer.php files, respectively. In each case, the manipulation of the 'Contact' argument allows for remote SQL injection attacks. These three High severity flaws (CVSSv3 7.3) were disclosed on the same day.
A fourth vulnerability, CVE-2026-116055, also a SQL injection flaw, affects the /opils/admin/deleteproduct.php file. This Medium severity vulnerability (CVSSv3 6.3) arises from the manipulation of the 'ID' argument and can be exploited remotely.
All disclosed vulnerabilities are present in version 1.0 of the SourceCodester Performance Indicator System. The descriptions indicate that exploits for all four CVEs are publicly available, suggesting a heightened risk of active exploitation. Users are strongly advised to consult SourceCodester's official advisories for specific patching information and mitigation strategies.
This batch of vulnerabilities underscores the importance of timely patching for the SourceCodester Performance Indicator System. The presence of multiple SQL injection flaws, coupled with publicly available exploits, creates a significant risk for organizations using this software. Users should prioritize updating to a patched version as soon as possible to mitigate potential security breaches.