A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

This is a SQL injection vulnerability (CWE-89) affecting the manage_user.php file. An unauthenticated remote attacker can manipulate the ID argument to execute arbitrary SQL commands against the backend database.

The ability to perform SQL injection allows unauthorized parties to read, modify, or delete sensitive data stored within the inventory system. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to user accounts or system configuration data.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the manage_user.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing SQL syntax, such as UNION, SELECT, or OR 1=1, directed at the manage_user.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified vulnerable argument.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Due to the lack of an official patch and the availability of a public proof-of-concept, this vulnerability poses a clear and present danger to affected environments. Organizations must prioritize immediate network-level mitigation or the implementation of strict WAF filtering to prevent unauthorized database access until the vendor releases a secure update.