A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize the ID argument within the /ajax.php?action=delete_receiving file, which allows an unauthenticated remote attacker to perform SQL injection. This flaw enables unauthorized interaction with the underlying database through the vulnerable endpoint.

Successful exploitation of this vulnerability permits unauthorized database access, which may lead to the exfiltration, modification, or deletion of sensitive inventory and sales data. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality. Organizations relying on this system for business operations face potential service disruption and compromise of proprietary financial information.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /ajax.php endpoint or disable the affected functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the /ajax.php file, specifically targeting the delete_receiving action.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE data.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by unauthorized actors. Organizations using Campcodes Grocery Sales and Inventory System 1.0 must treat this as a high priority and implement the suggested access restrictions immediately. Continuous monitoring for malicious traffic is essential until a formal patch is provided by the vendor.