The Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to unauthenticated remote SQL injection, which could allow an attacker to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) located in the /ajax.php endpoint via the ID parameter. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability can result in unauthorized access to sensitive data stored within the system database. With a CVSS score of 7.3, this flaw presents a high risk, as it allows for potential data exfiltration or modification without requiring any prior authentication, which could lead to significant operational disruption and loss of data integrity.

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the affected endpoint or disable the vulnerable functionality until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for requests directed to /ajax.php that contain suspicious characters or SQL syntax patterns, such as UNION, SELECT, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter in URL queries.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations must prioritize restricting access to the vulnerable system and implement robust input validation at the WAF level until an official security patch is provided by Campcodes.