---
id: "CVE-2026-116061"
kind: "vulnerability"
aliases: ["CVE-2026-116061"]
title: "SourceCodester Performance Indicator System: SQL injection via edit_dealer.php Contact field"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Performance Indicator System", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["no-fix", "other", "php", "self-hosted", "sourcecodester", "sql-injection"]
not_affected_if: ["network-restricted", "not-installed"]
published_at: "2026-10-25T18:16:46+00:00"
first_seen_at: "2026-10-25T19:05:28+00:00"
updated_at: "2026-10-25T19:07:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116061", "first_seen_at": "2026-10-25T19:05:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T19:07:15+00:00"}]
---

# SourceCodester Performance Indicator System: SQL injection via edit_dealer.php Contact field

SourceCodester Performance Indicator System 1.0 (a free sample PHP/MySQLi app) builds an SQL query from the contact field in /opils/staff/edit_dealer.php without sanitizing it. A public write-up shows a time-based blind SQL injection with sqlmap, which can read or change the database. Other pages in the same app have similar published injection bugs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Performance Indicator System affected 1.0 fixed ?

## How to check

- Look for /opils/staff/edit_dealer.php in your web root (the app lives under /opils/).
- Version 1.0 is the only one listed; the download carries no version marker beyond that.
- Review web logs for POSTs to /opils/staff/edit_dealer.php with SQL keywords or sleep() in the contact field.

## Fix

No fixed version or vendor patch found. Do not expose the app to the internet; remove it or restrict /opils/staff/ by IP or HTTP auth. If you keep it, change the code to use prepared statements (mysqli bind_param) for contact and the other fields in edit_dealer.php.

## Timeline

- 2026-10-25T19:05:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116061
- 2026-10-25T19:07:15+00:00 analyst — NVD + VulDB + public PoC issue (hubdk01/cve#12, sqlmap time-based blind on contact). No vendor advisory or fixed version found; SourceCodester is a hobby-code site, likely never patched. Auth unclear: report says no login needed but its PoC request carries a PHPSESSID cookie. No exploitation in the wild known. Siblings exist (CVE-2026-108964, -108967, -116055) in same app.

## Documents

- [advisory] VDB-426144 SourceCodester Performance Indicator System 1.0 edit_dealer.php contact sql injection https://vuldb.com/vuln/426144
- [poc] hubdk01/cve #12: Performance Indicator System edit_dealer.php SQL injection https://github.com/hubdk01/cve/issues/12

## From the sources

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_