Campcodes Courier Management System CVE-2025-8186

Vendor patch status is not documented in the provided references. Immediate mitigation requires upgrading to a patched version if available from Campcodes (verify at https://www.campcodes.com/ or contact vendor support). If no patch exists, implement compensating controls immediately: (1) Restrict network access to /edit_branch.php via web application firewall (WAF) rules-block requests containing SQL keywords (UNION, SELECT, OR, etc.) in the ID parameter; (2) Apply strict input validation in the application-whitelist ID to numeric values only (regex: ^[0-9]+$) and reject non-matching requests; (3) Use parameterized SQL queries (prepared statements) in the PHP code to replace all direct string concatenation with bound parameters, eliminating SQL injection vector entirely; (4) Run database user account with minimal privileges (read-only or limited to specific tables where possible) to reduce damage from successful injection; (5) Enable detailed SQL query logging and monitor for suspicious patterns (UNION, comment sequences, multiple semicolons). These controls trade ease-of-use for security but are necessary until patched.