Courier Management System CVE-2025-12316

No special conditions are required per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) - remote unauthenticated exploitation is possible against any internet-accessible instance of Courier Management System 1.0 running the vulnerable /courier/edit-courier.php file. The sole technical prerequisite is network reachability to that endpoint. Exploitation is limited in practice by the product's extremely small real-world footprint, as this is an obscure educational PHP project with negligible enterprise deployment. No non-default configuration is required to expose the flaw; however, the PR:N assignment originates from VulDB (cna@vuldb.com) rather than a vendor advisory, so authentication requirements should be independently verified - if the edit-courier.php page is behind a login wall in practice, exploitation would require valid credentials (PR:L at minimum).

The CVSS 4.0 base score of 5.5 (Medium) reflects full network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N), offset by limited impact across confidentiality, integrity, and availability (all VC/VI/VA:L). The presence of a publicly available exploit on GitHub elevates practical exploitability above the raw score, but the EPSS at 0.03% (8th percentile) strongly indicates no broad exploitation activity has been observed - consistent with an obscure, niche product unlikely to appear in enterprise inventories. No CISA KEV listing further supports low active threat actor interest. The primary real-world risk is opportunistic automated scanning of publicly exposed instances; targeted attacks are plausible given the PoC but improbable at scale. The low impact ratings (VC:L/VI:L/VA:L) suggest partial data exposure rather than full database compromise, though impact could escalate depending on the database user's privileges. The CVSS was assigned by cna@vuldb.com rather than an independent vendor or NVD analyst - the PR:N assessment (unauthenticated access) should be independently verified against the application's actual access controls.

An unauthenticated remote attacker submits a crafted HTTP request to /courier/edit-courier.php, injecting SQL metacharacters into the OfficeName parameter - for example, a UNION-based payload - to extract database contents including courier records, user credentials, or other PII stored in the application's tables. A proof-of-concept demonstrating this technique is publicly available on GitHub (https://github.com/Abxery/cveee/issues/1), lowering the skill barrier for exploitation significantly. Given the CVSS PR:N vector assignment, any internet-exposed instance is potentially directly targetable without prior authentication.