An unauthenticated SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to execute arbitrary database commands.

This flaw is a SQL injection (CWE-89) vulnerability occurring in the Username argument of the /pages/us_transac.php file. The vulnerability is exploitable by an unauthenticated remote attacker via simple HTTP GET or POST requests.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application database. Organizations relying on this system for inventory management face potential operational disruption if the underlying database is compromised.

Immediate Action: No official patch is currently available from the vendor. Administrators should immediately restrict access to the affected web directory or disable the vulnerable functionality until a security update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /pages/us_transac.php endpoint, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in incoming request parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/e1evensu/cve/issues/2.

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations should prioritize isolating the affected system or implementing strict WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.