A false username field in the admin login form of Shipping System CMS 1.0 permits a malicious user to inject SQL code that bypasses authentication. By submitting carefully crafted boolean‑based blind SQL statements in the POST payload, an attacker can cause the authentication logic to succeed without valid credentials, effectively gaining administrative access. The weakness originates from insufficient input sanitization and is identified as CWE‑89, a classic SQL injection vulnerability.

The vulnerability affects the Shipping System CMS version 1.0, developed by Wecodex. No other affected versions are listed. Only this product version should be checked for remediation.

The CVSS score of 8.8 signals high severity and indicates that an unauthenticated attacker could cause a full compromise of the system. EPSS data is unavailable, so the exploitation probability is uncertain, but the lack of a KEV listing does not negate the risk. Attackers would need only access to the web application to deliver the injection payload to the admin login endpoint, making exploitation trivial for anyone with network visibility.