A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute arbitrary database commands.

The application is susceptible to SQL injection via the ID parameter in the /ajax.php?action=save_category endpoint. This flaw allows unauthenticated remote attackers to inject malicious SQL queries, potentially leading to unauthorized data access or manipulation.

Successful exploitation of this SQL injection vulnerability could result in the unauthorized disclosure, modification, or deletion of sensitive inventory and sales data. Given the CVSS score of 7.3, this represents a high risk to business operations, as it allows unauthenticated attackers to interact directly with the backend database. Such breaches can lead to significant reputational damage and potential regulatory non-compliance regarding data protection.

Immediate Action: Since no vendor patch is currently confirmed, administrators should restrict access to the /ajax.php endpoint or disable the affected module until an official update is provided by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for unusual patterns or suspicious characters within the ID parameter of requests directed at /ajax.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/76.

This vulnerability presents a significant risk due to the ease of remote exploitation and the existence of a public proof-of-concept. Organizations utilizing this software must prioritize the implementation of compensating controls, such as strict WAF filtering, and monitor vendor communication channels for the release of an official security update to resolve this flaw permanently.