Courier Management System CVE-2026-9606

The specific prerequisite is the ability to reach the /manage_user.php endpoint and supply the 'ID' request parameter, which is the injectable input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, requires no user interaction, and is rated as needing no privileges. The practical limiting factor is endpoint reachability: /manage_user.php is typically an administrative user-management page, so deployments that place it behind authentication or network access controls would constrain or eliminate unauthenticated exploitation despite the PR:N rating - this should be verified against the actual deployment. Exploitation is further bounded to itsourcecode Courier Management System version 1.0.

The signals are mixed. The CVSS 3.1 base of 7.3 derives from a favorable attack surface (AV:N/AC:L/PR:N/UI:N) but limited consequences (C:L/I:L/A:L), and the temporal metrics (E:P, RC:R) reflect a proof-of-concept exploit with only 'reasonable' report confidence - typical of VulDB-sourced disclosures for small/abandoned applications. Proof-of-concept exploit code is publicly available, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation; treat this as exposure to opportunistic scanning rather than a confirmed in-the-wild threat. Note a tension worth verifying: the CVSS vector asserts PR:N (unauthenticated), yet /manage_user.php is conventionally an administrative user-management endpoint that may be access-controlled in real deployments - if so, real-world exploitability could require prior authentication, which would lower effective risk. Given the product is niche, low-deployment-count source code, prioritize accordingly: patch if you run it, but it is unlikely to be a fleet-wide emergency.

A remote attacker sends an HTTP request to /manage_user.php with a crafted 'ID' value (e.g., a UNION-based or boolean/time-based payload) to manipulate the backend SQL query. Because public proof-of-concept exploit code exists and the CVSS vector indicates network reach with low complexity and no required privileges, the attacker can enumerate and extract database contents such as user records and credentials, or in some configurations tamper with stored data.