The Campcodes Grocery Sales and Inventory System 1.0 contains a critical SQL injection flaw that permits unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located within the ajax.php file. An unauthenticated remote attacker can manipulate the ID argument to execute unauthorized database queries.

Successful exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to total system compromise or the exposure of sensitive grocery and inventory records.

Immediate Action: Since no official vendor patch is currently confirmed, users are advised to restrict network access to the affected endpoint or disable the vulnerable functionality in ajax.php until a security update is released by Campcodes.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests targeting ajax.php, specifically monitoring for SQL injection patterns such as union, select, or comment syntax in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application's URL parameters.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the provided GitHub reference.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing Campcodes Grocery Sales and Inventory System 1.0 must prioritize implementing compensating controls, such as WAF rules or network segmentation, to mitigate the risk of unauthorized database access while awaiting an official vendor patch.