SourceCodester Best Courier Management System GET Parameter parcel_list.php sql injection

Vulnerability

The vulnerability is a SQL injection in the GET parameter handler of parcel_list.php in SourceCodester Best Courier Management System version 1.0. The id or s parameter is not sanitized, allowing an attacker to inject arbitrary SQL queries. The affected version is 1.0 only [2].

Exploitation

An attacker can exploit this by sending a crafted HTTP GET request to parcel_list.php with malicious SQL in the id or s parameter. No authentication is required. The exploit has been publicly disclosed, including proof-of-concept details [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, leading to disclosure of sensitive data (e.g., user credentials, courier information) and potentially full database compromise.

Mitigation

As of publication, no official patch has been released. Users should apply input validation and parameterized queries to mitigate the risk. The vendor (SourceCodester) may not provide updates; consider migrating to a maintained solution [2].