A SQL injection flaw exists in the Courier Management System 1.0. The flaw is triggered by manipulating the ID argument in the edit_parcel.php file, allowing a remote attacker to inject arbitrary SQL statements. This can lead to unauthorized read, update, or deletion of parcel data and related information. The vulnerability aligns with CWE-74 (Improper Validation of SQL Statement Fragments) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The affected product is itsourcecode Courier Management System version 1.0, which includes the edit_parcel.php script. No mention of later versions or patching status is given, implying that only the original release contains the flaw.

The CVSS score of 6.9 denotes moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild, but publicly available exploits exist. The vulnerability is not listed in CISA’s KEV catalog. Because the attack can be initiated remotely by sending a crafted request to edit_parcel.php, the risk of data compromise remains significant for any exposed instance of the application.