CVE-2026-9607: itsourcecode Courier Management System parcel_list.php sql injection
A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcellist.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Courier Management System 1.0from your environment.Uninstall the affected application or remove the vulnerable /parcel_list.php script from the webroot until a vendor patch or update is available.
- Configuration
Disable public access to /parcel_list.php (for example, block the URL in the web server configuration or application routing) until the vulnerability is remediated.
itsourcecode Courier Management System (parcel_list.php) access = disabled - Compensating control
Deploy compensating network controls such as a Web Application Firewall (WAF) with rules to block SQL injection attempts (targeting the 's' parameter) and/or restrict access to the application to trusted IP ranges or internal networks.
- Operational
Review web server and application logs for signs of exploitation of /parcel_list.php. If compromise is suspected, follow incident response procedures (containment, cleanup, restore from known-good backups) and rotate any potentially exposed credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9607?
CVE-2026-9607 has a medium severity rating of 6.3.
How do I fix CVE-2026-9607?
To fix CVE-2026-9607, it is recommended to sanitize user inputs in the parcel_list.php file to prevent SQL injection.
What software is affected by CVE-2026-9607?
CVE-2026-9607 affects itsourcecode Courier Management System version 1.0.
How can CVE-2026-9607 be exploited?
CVE-2026-9607 can be exploited by manipulating the argument 's' in parcel_list.php to execute SQL injection attacks.
Is CVE-2026-9607 remotely exploitable?
Yes, CVE-2026-9607 can be exploited remotely.