A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute unauthorized database queries.

The application fails to properly sanitize the ID argument within the /ajax.php?action=save_supplier endpoint, leading to CWE-89 SQL Injection. This vulnerability is remotely exploitable by an unauthenticated attacker.

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive information, modify database records, or disrupt system operations, leading to potential data breaches and system downtime. Given the CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized access to the underlying database.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor web server logs for suspicious requests to the /ajax.php file, specifically looking for unusual patterns or characters in the ID parameter that resemble SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing SQL injection payloads targeting the specified endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Given the public availability of exploit material and the unauthenticated nature of this vulnerability, organizations currently running Campcodes Grocery Sales and Inventory System 1.0 are at elevated risk. We strongly recommend implementing immediate network-level restrictions to the affected file and maintaining heightened vigilance until the vendor provides an official security patch.