ABC Courier Management System
CVE-2025-8241
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess /report.php
-
DeliverySend crafted HTTP request with SQLi payload in From parameter
-
ExploitDatabase executes injected SQL
-
ExecutionExtract or modify courier management data
-
ImpactUnauthorized access or data manipulation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of ABC Courier Management System 1.0 by sending a malicious 'From' parameter to the /report.php endpoint. The application must be deployed with the vulnerable PHP file exposed. No prior authentication or user interaction is required, as indicated by the CVSS PR:N and UI:N metrics. |
| Impact | CVSS 4.0 base score is 5.5 (Medium), reflecting low impact on confidentiality, integrity, and availability. The EPSS probability is 0.09% (25th percentile), indicating very low real-world exploitation likelihood despite a publicly available PoC. The product is not listed in CISA KEV, and no active exploitation has been observed. The low enterprise prevalence and limited impact make this a low-priority risk for most organizations. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to /report.php with a malicious SQL payload in the 'From' parameter. The database executes the injected query, allowing the attacker to extract or modify courier records, user data, or other sensitive information stored in the database. The attack requires no user interaction and can be performed remotely over the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Unauthenticated SQL injection in ABC Courier Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'From' parameter of /report.php. Exploit code is publicly available, but active exploitation has not been confirmed. The product is a niche academic project with low deployment footprint, limiting real-world impact.
RemediationAI
No vendor patch is available, as the project appears unmaintained. As a workaround, remove or restrict access to /report.php via web server configuration or .htaccess rules, or implement a WAF rule to filter SQL injection attempts against the 'From' parameter. Restricting access to authenticated users may mitigate unauthenticated attacks but may not be feasible if reporting is required for all users. Disabling the endpoint entirely will break reporting functionality.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The software is a PHP-based courier management application from 1000projects, typically backed by MySQL. The CWE-74 (Improper Neutralization of Special Elements) class covers the failure to sanitize user input, leading to SQL injection in the 'From' parameter. CPE cpe:2.3:a:1000projects:abc_courier_management_system:1.0:*:*:*:*:*:*:* confirms the affected product is a single version 1.0 project from a tutorial/learning platform.
Know when Abc Courier Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote, no privileges or user interaction, low impact on all CIA, no scope change.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. This affects an unknown part of the file /report.php. The manipulation of the argument From leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Critical SQL injection vulnerability in 1000 Projects ABC Courier Management System version 1.0, affecting the /admin en
SQL injection in ABC Courier Management System 1.0 allows remote attackers to inject malicious SQL via the reciver_name
A critical SQL injection vulnerability exists in 1000projects ABC Courier Management version 1.0 affecting the /add_deal
Remote SQL injection in 1000 Projects ABC Courier Management System 1.0 allows unauthenticated attackers to execute arbi
Exploit-DB