CVE-2025-8186
📋 TL;DR
CVE-2025-8186 is a critical SQL injection vulnerability in Campcodes Courier Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the ID parameter in /edit_branch.php. This affects all deployments of version 1.0, potentially compromising the entire database. Organizations using this software for courier management are at risk.
💻 Affected Systems
- Campcodes Courier Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Database information disclosure, including sensitive customer data, shipment details, and potentially authentication credentials.
If Mitigated
Limited impact if proper input validation and WAF rules block malicious SQL payloads.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Simple SQL injection payloads work without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to only accept numeric values for ID parameter
Modify /edit_branch.php to validate ID parameter: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
Add WAF rule: SecRule ARGS:ID "@rx (?i)(union|select|insert|update|delete|drop|--|#|\/\*|\*\/)" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt'"
For ModSecurity: SecRule REQUEST_URI "@contains edit_branch.php" "id:1002,phase:1,chain"
SecRule ARGS:ID "@rx \D" "id:1003,phase:1,deny,status:403,msg:'Non-numeric ID parameter'"
For naxsi: MainRule "str:union" "msg:SQLi union" "mz:ARGS|BODY|URL|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1001;
For cloudflare: Create WAF rule blocking requests with SQL keywords in ID parameter
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit access to the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test with SQL injection payload: /edit_branch.php?ID=1' OR '1'='1Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Attempt SQL injection payloads and verify they are blocked or return error📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /edit_branch.php with SQL keywords in ID parameter
- Unusual database error messages in application logs
- Multiple failed login attempts following SQL injection attempts
Network Indicators:
- HTTP requests containing UNION, SELECT, OR '1'='1 in query parameters
- Abnormal database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/edit_branch.php" AND (query="*UNION*" OR query="*SELECT*" OR query="*OR '1'='1*")