SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control

Successful exploitation of CVE-2026-5330 allows an attacker to delete user accounts within the Best Courier Management System without proper authorization. This can disrupt operations, compromise sensitive data associated with those accounts (e.g., delivery information, contact details), and potentially grant the attacker administrative access if they delete a privileged user. The public availability of a proof-of-concept significantly increases the risk of widespread exploitation, particularly against systems with weak security configurations or those not actively monitored for intrusion attempts. The blast radius extends to all users of the affected system, as any user account could be targeted for deletion.

Organizations utilizing Best Courier Management System version 1.0, particularly those with limited security expertise or those hosting the system on shared hosting environments, are at significant risk. Systems with default configurations or those lacking regular security updates are especially vulnerable to exploitation.

• generic web: Use curl to test the /ajax.php?action=delete_user endpoint with various 'ID' parameters. Look for successful deletion responses without proper authentication.

curl 'http://your-target/ajax.php?action=delete_user&id=1' 

• php: Examine the /ajax.php file for missing or inadequate access control checks before deleting users. Search for code patterns that directly use the 'ID' parameter without validation. • generic web: Monitor web server access logs for requests to /ajax.php?action=delete_user originating from unusual IP addresses or containing suspicious 'ID' values.

1. 2026-04-02Disclosure

   disclosure

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-02
3. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-5330 is to upgrade to a patched version of Best Courier Management System. Since a fixed version is not specified, consider reverting to a previous, known-stable version if upgrading causes compatibility issues. As a temporary workaround, implement strict access controls on the /ajax.php?action=delete_user endpoint, requiring authentication and authorization checks before allowing user deletion. Web application firewalls (WAFs) can be configured to block requests with suspicious 'ID' parameter values. Monitor access logs for unusual deletion activity and implement intrusion detection systems (IDS) to alert on potential exploitation attempts.