A critical SQL injection vulnerability in the Campcodes Computer Sales and Inventory System 1.0 allows for remote, unauthenticated database manipulation.

This is a SQL injection vulnerability (CWE-89) located in the /pages/cust_edit1.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the ID argument, which is then processed by the application without sufficient sanitization.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive customer and inventory data stored within the database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or modification.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or disable the vulnerable module until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns in the ID parameter of requests directed at /pages/cust_edit1.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently running the affected version of the Campcodes system must prioritize the implementation of compensating controls or network isolation to prevent exploitation, as the lack of a vendor patch leaves the system directly exposed to remote attackers.