← back
CVE-2025-9759

Campcodes/SourceCodester Courier Management System ajax.php signup sql injection

CVSS 6.9 MEDIUMEPSS 0.4%CWE-74CWE-89
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
01 Sep 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Affected by this issue is the function Signup of the file /ajax.php. Performing manipulation of the argument lastname results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Campcodes · Courier Management SystemSourceCodester · Courier Management System

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/lrjbsyh/CVE_Hunter/issues/9#issue-3348584620https://vuldb.com/?ctiid.322060https://vuldb.com/?id.322060https://vuldb.com/?submit.640684