Affected is an unknown function in the file /edit_branch.php of itsourcecode Courier Management System. The application fails to validate the ID argument, permitting an attacker to inject SQL statements. The flaw is a classic SQL injection, classified under CWE-74 and CWE-89. Attackers can execute arbitrary queries remotely because the input is used directly in a database query.

Only the 1.0 release of the Courier Management System is reported as vulnerable. No other versions are listed, so any installations running 1.0 will be impacted. If newer releases exist, users should verify whether the edit_branch.php vulnerability has been addressed.

The official CVSS score of 6.9 indicates a moderate severity. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. According to the description, the attack can be carried out remotely by supplying a malformed ID value to the edit_branch.php endpoint. It is inferred that the endpoint is reachable without user authentication, implying that any actor who can reach the web interface could trigger the injection. If successful, the attacker could read, modify, or delete data in the underlying database.