Courier Management System vulnerabilities

In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.

In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.

A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.