Campcodes Courier Management System CVE-2025-8254

Q: What is the CVSS score of CVE-2025-8254?

CVE-2025-8254 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-28 cna@vuldb.com

PHP SQLi Courier Management System Campcodes

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:50 vuln.today

DescriptionCVE.org

A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Campcodes Courier Management System 1.0 via the ID parameter in /view_parcel.php allows authenticated remote attackers to execute arbitrary SQL queries with limited data exposure impact. The CVSS score of 2.1 reflects constraints imposed by authentication requirements (PR:L) and restricted scope, but publicly available exploit code exists; however, the 0.06% EPSS score indicates minimal real-world exploitation likelihood despite public disclosure.

Technical ContextAI

The vulnerability exists in the PHP application's handling of the ID parameter in the /view_parcel.php file. This is a classic second-order SQL injection (CWE-74: Improper Neutralization of Special Elements used in an Output Command) where user-supplied input is not properly sanitized before being incorporated into SQL queries. The affected product is built on PHP and manages parcel data, making the database queries handling user input a critical control point. The CPE indicates only version 1.0 of the Campcodes Courier Management System is documented as affected.

RemediationAI

Upgrade Campcodes Courier Management System to a patched version released by the vendor; consult https://www.campcodes.com/ for available updates beyond version 1.0. If an upgrade is not immediately available or feasible, implement the following compensating controls with trade-offs noted: (1) Restrict access to /view_parcel.php to authorized users only via IP whitelisting or Web Application Firewall rules - effective but reduces usability for remote staff; (2) Deploy a WAF rule to detect and block SQL injection patterns in the ID parameter (e.g., detect single quotes, SQL keywords like UNION, OR, comment sequences) - this mitigates risk but may generate false positives if legitimate parcel IDs contain special characters; (3) Apply input validation at the application level to enforce ID parameter format (e.g., numeric-only if IDs are numeric) - low side effects if implemented correctly, high effectiveness. Ensure all database user accounts associated with the Courier Management System operate with least-privilege permissions (SELECT only on parcel tables, no UPDATE/DELETE) to limit damage if SQL injection succeeds.