Campcodes Courier Management System CVE-2025-8190

CRITICAL CONDITION: Valid user authentication is required to reach the vulnerable endpoint. The vulnerability manifests only when an authenticated attacker manipulates the ids parameter in requests to /print_pdets.php; unauthenticated network access alone is insufficient. The 'unknown processing' description suggests the exact logic is unclear from public analysis, but SQL injection is confirmed in this parameter. Exploitation is limited by the underlying database user permissions (likely SELECT-heavy for a print/report function) and by any existing query filtering or escaping that may be partially present but bypassable. No indication of stored procedures, input validation bypass techniques, or multi-parameter chaining is documented.

This vulnerability presents a stark contradiction between classification and real-world risk. The 'critical' designation conflicts sharply with both the CVSS v4.0 score of 2.1 and the EPSS of 0.06% (19th percentile), indicating minimal actual exploitation probability. CVSS v4.0 vector shows PR:L (authenticated), meaning a valid user account is mandatory-eliminating opportunistic network-based attacks. Attack complexity is low (AC:L) but offset by low impact metrics: VC:L, VI:L, VA:L all indicate minimal compromise of confidentiality, integrity, and availability. The explicit impact (E:P) suggests public knowledge of the vulnerability, yet EPSS remains extremely low, suggesting either limited attacker interest, low practical exploitability despite known POC, or minimal installed base of vulnerable systems. For organizations running this software, the actual risk depends heavily on whether users with login credentials are trusted; SQL injection from authenticated insiders poses different risk than from external attackers. The contradiction between 'critical' label and 0.06% EPSS probability warrants vendor clarification on impact scope and real-world exploitation patterns.

An authenticated user with valid login credentials navigates to or crafts a request to /print_pdets.php and injects SQL metacharacters into the ids parameter (e.g., ids=1' OR '1'='1). The unvalidated input flows directly into the backend SQL query, allowing the attacker to extract database contents, bypass authorization checks, or manipulate query logic-all constrained by the database user's privileges and the application's processing logic.