An unauthenticated remote SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 poses a significant risk to database confidentiality and integrity.

This is a SQL injection vulnerability (CWE-89) located in the /pages/sup_searchfrm.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries remotely.

The ability for an unauthenticated user to inject arbitrary SQL commands into the backend database presents a severe risk of unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this flaw is categorized as High severity and could lead to complete compromise of the application data layer, potentially resulting in significant operational disruption and loss of sensitive inventory information.

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the affected directory /pages/sup_searchfrm.php or disable the vulnerable module until a fix is released by Campcodes.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the sup_searchfrm.php endpoint, specifically looking for URL parameters containing SQL syntax or encoded payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for mitigation. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must implement strict access controls and WAF filtering immediately to prevent potential database compromise until an official security update is provided by the vendor.