EUVD-2025-17320
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionNVD
A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown function of the file /admin. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in 1000 Projects ABC Courier Management System version 1.0, affecting the /admin endpoint's Username parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing real-world exploitation risk.
Technical ContextAI
This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), which encompasses SQL injection attacks. The root cause stems from insufficient input validation and sanitization of the Username parameter in the /admin administrative interface. User-supplied input is concatenated directly into SQL queries without parameterized statements or proper escaping, allowing attackers to inject malicious SQL syntax. The affected component processes authentication or administrative functions at the /admin file/path, making this a high-value attack surface. The vulnerability affects 1000 Projects ABC Courier Management System 1.0 specifically; the exact CPE would be: cpe:2.3:a:1000_projects:abc_courier_management_system:1.0:*:*:*:*:*:*:*
Share
External POC / Exploit Code
Leaving vuln.today