Description
A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Affected is the function Login of the file /ajax.php. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected products
campcodes: courier management system
References6
- github.com/lrjbsyh/CVE_Hunter/issues/8#issue-3348441601 ExploitIssue TrackingThird Party Advisory
- github.com/lrjbsyh/CVE_Hunter/issues/8#issue-3348441601 ExploitIssue TrackingThird Party Advisory
- vuldb.com/?ctiid.322058 Permissions RequiredVDB Entry
- vuldb.com/?id.322058 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.640675 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.640811 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0
-
5.5
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 41 · as of 8 November 2026
- CWE
- CWE-74CWE-89
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.