Campcodes and SourceCodester Courier Management System 1.0 is vulnerable to an unauthenticated SQL injection flaw that allows remote attackers to manipulate database queries.

The application fails to properly sanitize user input in the lastname parameter within the Signup function located in ajax.php. This allows an unauthenticated attacker to inject malicious SQL commands to interact directly with the backend database.

Successful exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data compromise and system instability for organizations relying on this software.

Immediate Action: As no official patch is currently available, users should restrict network access to the affected instance or disable the vulnerable registration functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting ajax.php, specifically looking for SQL syntax patterns or unusual character strings in the lastname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

This vulnerability presents a clear and immediate risk due to the availability of public exploit material and the lack of required authentication. Organizations currently running Courier Management System 1.0 must prioritize the implementation of WAF protections or network isolation to prevent exploitation while awaiting a formal vendor security update.