An unauthenticated SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

The application fails to properly sanitize user input in the ID parameter of the /ajax.php?action=save_receiving endpoint. This flaw allows an unauthenticated remote attacker to perform SQL injection attacks against the underlying database.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion of sensitive inventory and sales records. Given the CVSS score of 7.3, this high-severity vulnerability represents a substantial threat to the confidentiality and integrity of business operations and critical application data.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /ajax.php endpoint or disable the affected module entirely if it is not essential for business operations.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /ajax.php file, specifically looking for unusual patterns or SQL syntax characters within the ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, which serves as a critical virtual patch until an official vendor update is released.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher write-up at https://github.com/zzb1388/cve/issues/72.

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using Campcodes Grocery Sales and Inventory System 1.0 must treat this as a high-priority item, implementing the suggested WAF rules and access restrictions immediately to protect the application environment from unauthorized database access.