An unauthenticated SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 poses a critical risk of data compromise and unauthorized database interaction.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input sanitization in the ajax.php file. The vulnerability is accessible via the action=delete_user endpoint and requires no authentication to exploit.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification of inventory records, or complete compromise of the application user database, resulting in significant operational and reputational damage.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict network access to the application or disable the vulnerable ajax.php endpoint until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests targeting ajax.php, specifically looking for unusual patterns in the id parameter that include SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application interface.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Due to the lack of an official patch and the public availability of an exploit, this vulnerability presents an immediate and elevated risk to all deployments of version 1.0. Organizations are strongly urged to isolate affected systems from public-facing networks or implement strict WAF filtering to prevent exploitation until the vendor provides a formal remediation.