A specific PHP script in the Courier Management System (edit_user.php) allows an attacker to manipulate the ID argument, enabling SQL injection. The flaw is tied to improper handling of user input, aligning with CWE-74 (Improper Sanitization of SQL Parameters) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the input can be injected remotely, an attacker may extract or alter database contents, potentially compromising user data, system integrity, and confidentiality.

The vulnerable component is part of itsourcecode Courier Management System version 1.0, specifically the edit_user.php endpoint that processes user identification parameters. No other versions or components are currently documented as affected.

The CVSS score of 5.1 indicates a moderate impact, and no EPSS score is available, though the vulnerability has been publicly disclosed and is known to be exploitable from a remote location. The flaw can be triggered by sending a crafted request to the ID parameter of edit_user.php, implying a high likelihood for attackers lacking advanced tooling. As the issue is not listed in CISA KEV, it may be underslept; however, the existence of public exploits increases the risk. Monitoring and mitigation are recommended promptly.