| Titre | SourceCodester Performance Indicator System 1.0 SQL Injection |
|---|
| Description | During a security review of SourceCodester Performance Indicator System V1.0, a SQL injection vulnerability was identified in the category parameter of /opils/admin/view_product.php.
The value is used directly in an SQL WHERE clause without prepared statements, type validation, or escaping. Although the file is located under the admin directory, its authorization check only verifies that a session exists and does not verify the user's role. As a result, a low-privilege Dealer can reach and exploit the query.
sqlmap identified boolean-based blind, time-based blind, and UNION query injection. A manual UNION request also extracted usernames and plaintext passwords from the application database. A separate injected SLEEP(3) condition delayed the response for approximately three seconds. |
|---|
| La source | ⚠️ https://github.com/OnlyCMJB/cve/issues/4 |
|---|
| Utilisateur | OnlyCMJB (UID 100094) |
|---|
| Soumission | 21/09/2026 16:27 (il y a 15 jours) |
|---|
| Modérer | 06/10/2026 10:26 (15 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 413926 [SourceCodester Performance Indicator System 1.0 view_product.php category injection SQL] |
|---|
| Points | 20 |
|---|