This vulnerability affects itsourcecode Courier Management System 1.0, specifically in the /parcel_list.php file. An attacker can remotely exploit improper input validation of the 's' parameter to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. The vulnerability is publicly known, but no official fix or patch has been released by the vendor.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database used by the Courier Management System, potentially leading to unauthorized data access or modification. However, the impact is rated as limited in confidentiality, integrity, and availability according to the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or web application firewall rules to block malicious SQL injection attempts targeting the 's' parameter in /parcel_list.php. Monitor vendor channels for updates and patches.