itsourcecode Courier Management System CVE-2026-7076

No special conditions are required to exploit this vulnerability. The /edit_branch.php file processes the ID parameter without authentication (PR:N) or user interaction (UI:N), meaning any remote attacker can submit malicious input across the network (AV:N) with minimal technical complexity (AC:L). The vulnerability is exploitable in default deployments of itsourcecode Courier Management System 1.0 with no specific configuration, feature enablement, or user interaction prerequisites. The only limiting factor is that successful exploitation requires the /edit_branch.php endpoint to be reachable from the attacker's network position - if the application is deployed on an internal network without external routing, remote exploitation is not feasible.

The CVSS v4.0 score of 6.9 reflects a network-accessible vulnerability with low attack complexity and no authentication requirements, resulting in limited impact to confidentiality, integrity, and availability. However, the presence of publicly available exploit code (POC) and the designation as exploitable (E:P in CVSS vector) elevates real-world risk significantly. The attack vector is network-based with low complexity, meaning any remote user can trivially craft malicious requests. While CVSS assigns only 'limited' impact ratings rather than 'high' or 'complete', SQL injection vulnerabilities typically allow database enumeration and potential privilege escalation within the application context. The lack of authentication requirements (PR:N, UI:N) is the critical risk factor - no credentials or user interaction needed. This is a genuine priority issue: SQL injection combined with network accessibility and public exploits creates substantial risk for any organization running this system in production, particularly since the vulnerability affects all version 1.0 deployments with no version discrimination noted.

An attacker discovers the itsourcecode Courier Management System deployed at a logistics company's web server. Without authentication, they craft a malicious HTTP request to /edit_branch.php with a specially crafted ID parameter containing SQL syntax such as ID=1' UNION SELECT username,password FROM admin_users-- to extract administrator credentials. The server executes the injected SQL against the backend database and returns sensitive data in the error message or response body. The attacker then uses extracted credentials to gain elevated access to the application or directly compromises the database.