Courier Management System
CVE-2025-12316
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated SQL injection with partial CIA impact; unchanged scope as no lateral system compromise is indicated by available data.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in code-projects Courier Management System 1.0 exposes the /courier/edit-courier.php endpoint to unauthenticated remote attackers who can manipulate the OfficeName parameter to execute arbitrary SQL against the backend database. A publicly available exploit exists on GitHub (PoC by Abxery), though the EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation activity. The vulnerability is not listed in CISA KEV, consistent with the product's extremely limited production deployment footprint.
Technical ContextAI
The affected product is a PHP-based courier dispatch web application distributed by code-projects.org (CPE: cpe:2.3:a:carmelogarcia:courier_management_system:1.0). The vulnerable file /courier/edit-courier.php accepts an OfficeName parameter that is concatenated directly into a SQL query without parameterized binding or input sanitization - a classic unsanitized-input injection pattern. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) is the assigned root cause class, broadly covering injection flaws; the specific manifestation is SQL injection, a CWE-89 sub-type. PHP applications of this generation frequently use legacy mysqli_query() with string interpolation rather than prepared statements, which is the likely underlying cause here.
RemediationAI
No vendor-released patch has been identified at time of analysis; the product appears to be an educational or demo PHP project with no active security maintenance. The primary fix is to replace direct SQL string interpolation in /courier/edit-courier.php with parameterized prepared statements using PHP's PDO or MySQLi bind_param(), which eliminates the injection surface entirely. As a compensating control, restrict access to the /courier/edit-courier.php endpoint via web server access controls (Apache .htaccess AllowFrom directive or Nginx allow/deny blocks) to trusted IP ranges only, limiting exposure until code remediation is complete - note this does not fix the underlying flaw and is bypassable if IP restrictions are misconfigured. Additionally, apply least-privilege database credentials so the web application's DB user is restricted to SELECT/INSERT/UPDATE on required tables only, preventing privilege escalation or schema manipulation via SQL injection. Organizations running this software in any production capacity should strongly consider replacing it with a maintained application, given the absence of upstream security support. The exploit PoC at https://github.com/Abxery/cveee/issues/1 provides reproduction details useful for verifying remediation effectiveness.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today