An unauthenticated SQL injection vulnerability in the Courier Management System 1.0 poses a significant risk of data compromise due to its remote exploitability.

The application suffers from a SQL injection flaw located in the edit-courier.php file, specifically within the OfficeName parameter. This vulnerability can be triggered remotely by an unauthenticated attacker, allowing for unauthorized interaction with the underlying database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized database access, potentially resulting in the exfiltration of sensitive courier data or modification of system records. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it allows remote attackers to bypass application logic without prior authentication. Such an incident could result in severe data loss, operational disruption, and potential regulatory non-compliance.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or implement strict input validation on the OfficeName parameter.

Proactive Monitoring: Security teams should review web server access logs for anomalous HTTP requests targeting edit-courier.php, particularly those containing SQL syntax or unusual character strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns directed at the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

The presence of a publicly available proof-of-concept significantly elevates the risk profile of this vulnerability. Organizations using Courier Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and isolate the vulnerable system from public-facing networks until an official vendor update is released and applied. Failure to act may result in unauthorized database access by external actors.