The Campcodes Grocery Sales and Inventory System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) triggered through the ID argument in the /ajax.php?action=save_product file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification, or deletion of sensitive inventory and sales records. With a CVSS score of 7.3, this represents a high risk to business operations, potentially compromising the integrity and confidentiality of the entire sales management database.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected module until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for anomalous requests targeting /ajax.php, specifically looking for URL parameters containing SQL syntax or unusual query strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection patterns targeting the ID parameter in the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/77.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses a significant risk of exploitation. Organizations using this software should prioritize network-level blocks and monitor for suspicious activity immediately to prevent potential database compromise.