CVE Alert: CVE-2025-9757 – Campcodes – Courier Management System

Risk verdict

High risk with a publicly disclosed exploit; treat as priority 1 given KEV presence and remote exploitation potential.

Why this matters

Remote SQL injection in the login routine can expose or alter backend data without user interaction, risking customer data, orders, and system integrity. The public availability of an exploit raises the likelihood of automated scans and rapid opportunistic attacks against exposed web interfaces.

Most likely attack path

Attacker, from the internet, targets the login AJAX endpoint and injects crafted input in the email parameter to trigger a SQLi. No authentication or user interaction is required, and the impact can include partial data disclosure or modification within the database, with potential for follow-on access if DB credentials or accounts are compromised. The vulnerability’s scope remains within the affected application’s data layer.

Who is most exposed

Web-facing courier-management or similar logistics apps deployed on shared hosting or cloud VMs are typical targets, especially in small to mid-sized organisations with limited network segmentation and weak input handling.

Detection ideas

• Unusual login AJAX requests with malicious payloads to /ajax.php
• SQL error messages or anomalies in application logs during login attempts
• Spikes in failed authentication or data access patterns from external IPs
• WAF alerts for SQL injection patterns on the login endpoint
• Post-exploitation indicators (unexpected data reads or writes) in DB audit logs

Mitigation and prioritisation

• Apply vendor patch or hotfix immediately; if unavailable, implement compensating controls (input validation, parameterised queries, disable detailed error messages).
• Enforce least-privilege DB accounts and separate web/app DB roles from admin credentials.
• Deploy web application firewall rules targeting SQLi signatures on the login endpoint; monitor and block suspicious payloads.
• Restrict public access to the login function where feasible and implement strong network segmentation.
• Expedite change management and testing; plan a rapid patch window. Treat as priority 1 due to KEV presence.