itsourcecode Courier Management System CVE-2026-7077

The vulnerability requires only that the itsourcecode Courier Management System 1.0 is deployed and the /edit_parcel.php endpoint is accessible over the network. No authentication is required - any remote attacker can send a request to the vulnerable endpoint. No special configuration or non-default settings are needed; the vulnerability exists in the base application. The only limiting factor is network connectivity to the vulnerable instance; if the system is deployed on an isolated or restricted network, exploitation risk is reduced. Conversely, if the system is exposed to the public internet without network-level access controls, exploitation risk is maximized.

The CVSS 6.9 vector indicates network-accessible exploitation (AV:N), low complexity (AC:L), no authentication required (PR:N), and low but real impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The presence of publicly available exploit code combined with remote unauthenticated access significantly elevates practical risk despite the moderate CVSS score - this is not a high-CVSS-but-low-real-risk issue. Any publicly exposed instance of Courier Management System 1.0 can be compromised without credentials. The lack of KEV confirmation in provided data may reflect recency of analysis or limited CISA tracking of smaller software projects, but the public exploit and simple attack vector (network parameter injection) mean this should be treated as a high-priority vulnerability for affected organizations. The CVSS E:P (Exploit: Proof-of-Concept) confirms public exploit code existence, validating the practical exploitation risk.

An attacker crafts a malicious HTTP request to the /edit_parcel.php endpoint with a SQL injection payload in the ID parameter (e.g., ID=1' OR '1'='1). The server processes this unsanitized input directly into a SQL query, allowing the attacker to retrieve sensitive parcel or user data, modify database records, or bypass access controls. Because no authentication is required and the endpoint is network-accessible, this can be performed by anyone with knowledge of the application's URL.