The Shipping System CMS 1.0 contains a classic SQL injection flaw that allows an attacker to inject code into the username field of the admin login form. By crafting boolean‑based blind SQL payloads, the attacker can force the system to authenticate without valid credentials. This critical flaw belongs to the CWE‑89 class and, once exploited, grants the attacker privileged access to the administrative interface, enabling read, modify, or delete operations on the underlying database and compromising the confidentiality, integrity, and availability of the CMS.

This vulnerability affects the Wecodex Shipping System CMS version 1.0. No other versions have been listed as impacted by the available data.

The weakness is rated with a CVSS score of 8.8, indicating high severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely, and the issue is not present in CISA’s KEV list. The attack vector is inferred to be a web‑based SQL injection executed against the admin login endpoint, requiring no prior authentication. If an attacker can reach this endpoint, the boolean-based blind approach can be used to authenticate and then leverage unrestricted administrative privileges.