{"id":"CVE-2026-116062","kind":"vulnerability","aliases":["CVE-2026-116062"],"related":[],"title":"SourceCodester Performance Indicator System: SQL injection via profile Contact field","description":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.","summary":"The Performance Indicator System 1.0 PHP application does not sanitize the Contact argument in /opils/staff/save_profile.php before using it in a SQL query. A remote attacker can alter database queries to read or change stored data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sourcecodester"],"not_affected_if":["product-not-installed"],"how_to_check":"- Look for the file `opils/staff/save_profile.php` on the server running Performance Indicator System\n- Check whether the Contact parameter is passed into SQL queries without prepared statements\n- unknown for exact affected versions beyond 1.0","fix":"- unknown: the sources do not name a patched release or vendor fix\n- Restrict access to the staff profile page until a fix is applied","status":"open","published_at":"2026-10-25T18:16:46+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","triaged_at":"2026-10-25T19:06:50+00:00","updated_at":"2026-10-25T19:06:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T19:06:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched release or vendor fix\n- Restrict access to the staff profile page until a fix is applied","reach":"internet","title":"SourceCodester Performance Indicator System: SQL injection via profile Contact field","impact":"medium","summary":"The Performance Indicator System 1.0 PHP application does not sanitize the Contact argument in /opils/staff/save_profile.php before using it in a SQL query. A remote attacker can alter database queries to read or change stored data.","category":"other","nicknames":[],"who_cares":["php","sourcecodester","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters database contents through injected SQL queries","analyst_note":"Confirm whether the staff profile save path requires a logged-in session and whether a fix exists; check the NVD entry for exploit details.","how_to_check":"- Look for the file `opils/staff/save_profile.php` on the server running Performance Indicator System\n- Check whether the Contact parameter is passed into SQL queries without prepared statements\n- unknown for exact affected versions beyond 1.0","needs_analyst":true,"not_affected_if":["product-not-installed"],"who_is_affected":"Teams running SourceCodester Performance Indicator System 1.0 with the OPILS staff module reachable from the network. The flaw sits in the staff profile save handler, so instances where that page is not exposed carry less risk. Sites not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3315,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116062':13A,16A '-2026':12A,15A '/opils/staff/save_profile.php':37B,79C '1.0':27B,69C 'affect':72C 'alter':49B 'applic':29B 'argument':35B,84C 'attack':47B,91C,109C 'chang':55B 'contact':9A,34B,85C 'cve':11A,14A 'data':57B 'databas':50B 'discov':63C 'exploit':97C 'field':10A 'file':78C 'flaw':60C 'host':21B 'indic':3A,25B,67C 'inject':6A,89C 'issu':71C 'launch':94C 'manipul':81C 'may':92C,105C 'perform':2A,24B,66C 'php':18B,28B 'process':75C 'profil':8A 'public':103C 'queri':44B,51B 'read':53B 'releas':100C 'remot':46B,95C 'result':86C 'sanit':32B 'secur':59C 'self':20B 'self-host':19B 'sourcecodest':1A,22B,65C 'sql':5A,43B,88C 'store':56B 'system':4A,26B,68C 'unknown':74C 'use':39B,107C 'via':7A","nicknames":[],"mitigations":[],"who_affected":"Teams running SourceCodester Performance Indicator System 1.0 with the OPILS staff module reachable from the network. The flaw sits in the staff profile save handler, so instances where that page is not exposed carry less risk. Sites not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T18:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116062","severity":null,"published_at":"2026-10-25T18:16:46+00:00","modified_at":"2026-10-25T18:16:46+00:00","first_seen_at":"2026-10-25T19:05:28+00:00","fetched_at":"2026-10-25T19:05:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}