Courier Management System CVE-2025-11553

The attacker must possess a valid user account with permissions to access the /add-courier.php page and submit the form - this is the critical prerequisite. The application must not use parameterized queries or input validation on the Shippername parameter. Standard SQL injection techniques apply: the SQL parser must interpret the user input as executable code rather than literal string data. No other special configuration, non-default settings, or protocol features are required beyond normal web application authentication. The attack is blocked only by valid credential requirement and application-level input filtering, neither of which are present in version 1.0 per the CVE description.

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates network-accessible SQL injection with low attack complexity but mandatory low-privilege authentication (PR:L), which substantially constrains real-world exploitation. The low CVSS score of 2.1 aligns with the limited impact scope - CIA ratings of L (Low) across all three categories, meaning confidentiality, integrity, and availability are minimally affected. The EPSS score of 0.03% (8th percentile) reflects a genuinely low exploitation probability in the wild, typical of authenticated vulnerabilities in niche applications. Critically, the presence of publicly available exploit code (referenced in GitHub) contradicts the low EPSS and CVSS - this apparent discrepancy suggests the exploit requires valid application credentials and targets a small user base, making mass exploitation unlikely despite technical exploit availability. The SQL injection is not completely mitigated by authentication alone; an insider threat or compromised low-privilege account could still extract sensitive data. Defenders should treat this as medium-priority for environments where the Courier Management System is deployed with multiple users having add-courier permissions.

An employee with valid Courier Management System credentials logs in and navigates to the add-courier form. Instead of entering a legitimate shipper name, they inject SQL syntax into the Shippername field such as '; DROP TABLE couriers; -- or a UNION-based SELECT statement to extract customer data from other tables. Upon form submission, the /add-courier.php file processes the malicious input without sanitization, and the injected SQL executes in the application's database context, either modifying data or exfiltrating information depending on the attacker's objective.