CVE-2025-8190
📋 TL;DR
This critical SQL injection vulnerability in Campcodes Courier Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ids' parameter in /print_pdets.php. This could lead to data theft, modification, or deletion. All users running the vulnerable version are affected.
💻 Affected Systems
- Campcodes Courier Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive data exfiltration, data destruction, and potential system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized access to sensitive courier management data, customer information theft, and potential data manipulation affecting business operations.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or limited data exposure.
🎯 Exploit Status
Public exploit available on GitHub. SQL injection is straightforward to exploit with common tools like sqlmap.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd proper input validation and parameterized queries to /print_pdets.php
Modify print_pdets.php to use prepared statements: $stmt = $conn->prepare('SELECT * FROM table WHERE id = ?'); $stmt->bind_param('i', $ids);
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns
Add WAF rule: SecRule ARGS_NAMES "ids" "id:1001,phase:2,deny,status:403,msg:'SQLi attempt detected'"
🧯 If You Can't Patch
- Restrict access to /print_pdets.php endpoint using network ACLs or authentication
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test /print_pdets.php endpoint with SQL injection payloads like: ids=1' OR '1'='1Check Version:
Check system documentation or admin panel for version informationVerify Fix Applied:
Test with same payloads and verify no SQL errors or unexpected data returned📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web logs
- Multiple requests to /print_pdets.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, etc.) in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/print_pdets.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR '1'='1*")