Description
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Published: 2026-05-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An injection flaw exists in the manage_user.php component of itsourcecode Courier Management System. The vulnerability is triggered by manipulating the ID argument, allowing an attacker to insert arbitrary SQL code into database queries. This weakness, classified as CWE-74 and CWE-89, can lead to unauthorized data disclosure, modification, or execution of arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the application’s underlying data.

Affected Systems

The flaw affects the Courier Management System version 1.0 developed by itsourcecode. No additional version constraints or sub‑product information are available from the incoming data.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating moderate severity, and there is no EPSS score provided. It is not listed in the CISA KEV catalog. The remote nature of the attack, coupled with the lack of a publicly available patch, suggests that exploitation is feasible by any remote actor capable of sending crafted requests to the unprotected ID parameter.

Generated by OpenCVE AI on May 27, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Modify all database interactions involving the ID parameter to use prepared statements or parameterized queries, eliminating direct string concatenation of user input.
  • Restrict direct access to the manage_user.php page to authenticated administrators and enforce strict input validation or implement a web application firewall to filter suspicious SQLpayloads.
  • Contact itsourcecode for official remediation or newer releases, and apply any vendor‑issued patch or update as soon as it becomes available.

Generated by OpenCVE AI on May 27, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 26 May 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Title itsourcecode Courier Management System manage_user.php sql injection
First Time appeared Itsourcecode
Itsourcecode courier Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:courier_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode courier Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Courier Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-27T12:33:01.449Z

Reserved: 2026-05-26T16:16:23.449Z

Link: CVE-2026-9606

cve-icon Vulnrichment

Updated: 2026-05-27T12:32:57.952Z

cve-icon NVD

Status : Deferred

Published: 2026-05-27T00:16:39.333

Modified: 2026-06-17T11:05:32.217

Link: CVE-2026-9606

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T04:00:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')