Executive brief
The Courier Management System, a web application used for managing delivery logistics, contains a security flaw that allows unauthorized access to its database. By sending a specially crafted web request, an attacker can bypass security controls to view, modify, or delete sensitive information such as user records and system data. This could lead to a total compromise of the application's data and disruption of delivery operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Courier Management System 1.0 within the 'manage_user.php' component. The application fails to sanitize the 'id' GET parameter before concatenating it into a SQL query string (e.g., SELECT * FROM users where id = ...). An unauthenticated remote attacker can exploit this by submitting malicious SQL payloads, including boolean-based, time-based, and UNION-based injections. Successful exploitation allows for full database enumeration, data extraction, and potential modification of user records. The vulnerability can be mitigated by implementing prepared statements with parameterized queries.
Affected products
- itsourcecode Courier Management System Project In PHP 1.0
Timeline
- 2026-05-02: disclosed: Initial public disclosure of the exploit by liuhanzhi
- 2026-05-27: advisory: NVD publication date