A SQL injection vulnerability exists in the Courier Management System 1.0, triggered by manipulating the argument "s" in the /parcel_list.php script. The flaw allows an attacker to inject arbitrary SQL statements into the database query. The weakness is the result of improper input validation and lack of parameterized queries, which is reflected in CWE-74 and CWE-89. Successful exploitation can lead to unauthorized data disclosure, modification or loss, and could compromise the entire system’s database integrity.

The affected product is itsourcecode Courier Management System, version 1.0. No other versions were explicitly listed as impacted.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS is not reported, and the defect is not listed in the CISA KEV catalog. The flaw can be exercised remotely by sending a crafted HTTP request to /parcel_list.php that contains a manipulated "s" parameter. The CVE does not state whether authentication is required, so the possibility of unauthenticated exploitation cannot be confirmed from the provided information.