An SQL injection vulnerability in itsourcecode Courier Management System 1.0 exposes the underlying database to unauthorized manipulation by remote attackers.

This issue is an SQL injection flaw (CWE-89) located in the /edit_staff.php file, specifically within the GET parameter id, allowing unauthenticated remote attackers to execute arbitrary database commands.

A successful exploitation of this vulnerability can lead to sensitive data leakage, data tampering, and potential comprehensive system compromise. Given the CVSS score of 7.3, the risk is classified as high because an attacker can interact with the backend database without prior authentication, threatening operational integrity and data confidentiality.

Immediate Action: Review the source code of /edit_staff.php and refactor database queries to use prepared statements and parameter binding instead of concatenating user input.

Proactive Monitoring: Monitor web and database access logs for unusual error patterns, anomalous query structures, and unexpected execution times associated with the /edit_staff.php endpoint.

Compensating Controls: Deploy a Web Application Firewall rule to inspect GET requests targeting /edit_staff.php and block common SQL injection payloads.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/ltranquility/submit/issues/11).

Organizations utilizing itsourcecode Courier Management System version 1.0 face significant risk due to available proof-of-concept code and lack of an official patch. Administrators must apply source code modifications to enforce strict input validation and parameter binding immediately to mitigate potential database compromise.