{"id":"CVE-2026-116061","kind":"vulnerability","aliases":["CVE-2026-116061"],"related":[],"title":"SourceCodester Performance Indicator System: SQL injection via edit_dealer.php Contact field","description":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.","summary":"SourceCodester Performance Indicator System 1.0 (a free sample PHP/MySQLi app) builds an SQL query from the contact field in /opils/staff/edit_dealer.php without sanitizing it. A public write-up shows a time-based blind SQL injection with sqlmap, which can read or change the database. Other pages in the same app have similar published injection bugs.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Performance Indicator System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["no-fix","other","php","self-hosted","sourcecodester","sql-injection"],"not_affected_if":["network-restricted","not-installed"],"how_to_check":"- Look for /opils/staff/edit_dealer.php in your web root (the app lives under /opils/).\n- Version 1.0 is the only one listed; the download carries no version marker beyond that.\n- Review web logs for POSTs to /opils/staff/edit_dealer.php with SQL keywords or sleep() in the contact field.","fix":"No fixed version or vendor patch found. Do not expose the app to the internet; remove it or restrict /opils/staff/ by IP or HTTP auth. If you keep it, change the code to use prepared statements (mysqli bind_param) for contact and the other fields in edit_dealer.php.","status":"open","published_at":"2026-10-25T18:16:46+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","triaged_at":"2026-10-25T19:06:50+00:00","updated_at":"2026-10-25T19:07:15+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T19:06:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Performance Indicator System: SQL injection via edit_dealer.php Contact field","impact":"high","summary":"The Performance Indicator System 1.0 web app does not sanitize the Contact parameter in /opils/staff/edit_dealer.php before using it in a database query. A remote attacker can inject SQL to read or change the application's database.","category":"other","nicknames":[],"who_cares":["php","self-hosted","sourcecodester"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters the application database remotely","analyst_note":"Check the NVD entry and the SourceCodester download page for a fixed version or patch, and confirm whether authentication is required to reach edit_dealer.php.","how_to_check":"- Check whether the file `/opils/staff/edit_dealer.php` exists on your server.\n- Confirm the installed version of Performance Indicator System (SourceCodester) is `1.0`.","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Sites that run SourceCodester Performance Indicator System 1.0 with the edit_dealer.php page reachable. Installations that do not use this software can skip it. The sources do not say whether a patch or newer version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000576,"input_tokens":3313,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the SourceCodester download page for a fixed version or patch, and confirm whether authentication is required to reach edit_dealer.php.","search":"'-116061':13A,16A '-2026':12A,15A '/opils/staff/edit_dealer.php':51B,106C '1.0':36B,97C 'affect':100C 'app':41B,82B 'argument':111C 'attack':118C 'avail':127C 'base':64B 'blind':65B 'bug':87B 'build':42B 'chang':74B 'code':102C 'contact':9A,48B,112C 'cve':11A,14A 'databas':76B 'edit_dealer.php':8A 'exploit':124C 'field':10A,49B 'file':105C 'fix':22B 'free':38B 'host':27B 'identifi':91C 'indic':3A,34B,95C 'indicator':18A 'initi':121C 'inject':6A,31B,67B,86B,116C 'lead':113C 'manipul':108C 'may':119C 'might':129C 'no-fix':20B 'page':78B 'perform':2A,33B,94C 'performance':17A 'php':24B 'php/mysqli':40B 'public':56B,126C 'publish':85B 'queri':45B 'read':72B 'remot':122C 'sampl':39B 'sanit':53B 'self':26B 'self-host':25B 'show':60B 'similar':84B 'sourcecodest':1A,28B,32B,93C 'sql':5A,30B,44B,66B,115C 'sql-inject':29B 'sqlmap':69B 'system':4A,19A,35B,96C 'time':63B 'time-bas':62B 'unknown':101C 'use':131C 'via':7A 'vulner':89C,99C 'without':52B 'write':58B 'write-up':57B","nicknames":[],"mitigations":[],"who_affected":"Sites that run SourceCodester Performance Indicator System 1.0 with the edit_dealer.php page reachable. Installations that do not use this software can skip it. The sources do not say whether a patch or newer version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T18:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116061","severity":null,"published_at":"2026-10-25T18:16:46+00:00","modified_at":"2026-10-25T18:16:46+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","fetched_at":"2026-10-25T19:05:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116061:822","url":null,"severity":null,"published_at":"2026-10-25T19:07:15+00:00","modified_at":"2026-10-25T19:07:15+00:00","first_seen_at":"2026-10-25T19:07:15+00:00","fetched_at":"2026-10-25T19:07:15+00:00","note":"NVD + VulDB + public PoC issue (hubdk01/cve#12, sqlmap time-based blind on contact). No vendor advisory or fixed version found; SourceCodester is a hobby-code site, likely never patched. Auth unclear: report says no login needed but its PoC request carries a PHPSESSID cookie. No exploitation in the wild known. Siblings exist (CVE-2026-108964, -108967, -116055) in same app."}],"documents":[{"id":3584,"url":"https://github.com/hubdk01/cve/issues/12","title":"hubdk01/cve #12: Performance Indicator System edit_dealer.php SQL injection","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3585,"url":"https://vuldb.com/vuln/426144","title":"VDB-426144 SourceCodester Performance Indicator System 1.0 edit_dealer.php contact sql injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}