This vulnerability involves an SQL injection in the Courier Management System 1.0 by itsourcecode. Specifically, the issue is in an unspecified function in /manage_user.php where the ID parameter is not properly sanitized, allowing attackers to inject SQL queries remotely. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The impact includes limited confidentiality, integrity, and availability violations. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or partial disruption of service. The impact is limited to the scope of the affected function and database access controlled by the application. Since the vulnerability is remotely exploitable without authentication, it poses a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation and parameterized queries as a temporary mitigation. Monitoring for unusual database queries or access patterns may help detect exploitation attempts. Avoid exposing the vulnerable endpoint to untrusted networks if possible.