Simple Logistic Hub Parcel’s Management System version 1.0 contains a SQL Injection vulnerability in the /manage_carrier.php script. Unvalidated input may allow an attacker to inject arbitrary SQL, potentially retrieving, modifying, or deleting data in the underlying database. The vulnerability carries a low CVSS score of 2.7, indicating limited impact if accessed only locally or under specific conditions, but still poses a risk of data leakage or accidental corruption.

The affected system is the Simple Logistic Hub Parcel’s Management System, version 1.0, as distributed by oretnom23. No other vendors or products are listed.

The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild, and the issue is not currently tracked in CISA’s KEV catalog. Based on the description, the most likely attack vector is a web‑based interface that accepts unfiltered user input in /manage_carrier.php. If an attacker can submit crafted requests to this endpoint, they could manipulate the SQL statements executed by the application. Though the reported severity is low, any deployment of the unchanged application remains susceptible.