The Campcodes Computer Sales and Inventory System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize user input in the ID parameter of the /pages/cust_searchfrm.php file during edit actions. This SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary database commands.

This vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could allow attackers to bypass authentication, extract sensitive customer or inventory data, or modify database contents, leading to potential operational disruption and loss of trust. The CVSS score of 7.3 reflects the high risk posed by an unauthenticated remote attack vector.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /pages/cust_searchfrm.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as SQL syntax characters or unexpected queries targeting the cust_searchfrm.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting query parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the security researcher's submission on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Computer Sales and Inventory System 1.0 must implement network-level access controls or WAF protections to mitigate the risk of unauthorized database interaction until the vendor provides a formal security update.