CVE-2026-7077

itsourcecode Courier Management System edit_parcel.php sql injection

View on CVE.org
Published Apr 27, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /edit_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A SQL injection flaw exists in the Courier Management System 1.0. The flaw is triggered by manipulating the ID argument in the edit_parcel.php file, allowing a remote attacker to inject arbitrary SQL statements. This can lead to unauthorized read, update, or deletion of parcel data and related information. The vulnerability aligns with CWE-74 (Improper Validation of SQL Statement Fragments) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Affected Systems

The affected product is itsourcecode Courier Management System version 1.0, which includes the edit_parcel.php script. No mention of later versions or patching status is given, implying that only the original release contains the flaw.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild, but publicly available exploits exist. The vulnerability is not listed in CISA’s KEV catalog. Because the attack can be initiated remotely by sending a crafted request to edit_parcel.php, the risk of data compromise remains significant for any exposed instance of the application.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Validate and sanitize the ID parameter by using prepared statements or parameterized queries to eliminate the possibility of SQL injection.
  • Apply any vendor‑supplied patch or upgrade to a newer version that resolves the flaw; if no patch is available, disable remote access to edit_parcel.php until a fix is released.
  • Deploy a Web Application Firewall or similar filtering mechanism to detect and block SQL injection payloads targeting the edit_parcel.php endpoint.

Generated by OpenCVE AI on April 28, 2026 at 04:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode courier Management System
Vendors & Products Itsourcecode
Itsourcecode courier Management System
Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /edit_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Title itsourcecode Courier Management System edit_parcel.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 1:44 PM
Reserved
Apr 26, 2026, 7:56 AM

View source JSON

Updated
Apr 29, 2026, 1:43 PM

JSON

Status
Deferred
Published
Apr 27, 2026, 3:15 AM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
Apr 28, 2026, 5:00 AM

JSON