A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to remote data manipulation and unauthorized database access.

This vulnerability is a SQL injection flaw located in the /pages/sup_edit1.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the ID parameter.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data disclosure, modification, or destruction of inventory records. Successful exploitation allows for complete interaction with the backend database, which may result in significant operational disruption and the compromise of sensitive business information.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable /pages/sup_edit1.php file if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the sup_edit1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable argument.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations must prioritize limiting exposure by placing the application behind a WAF or restricting network access until the vendor releases a security update. Continuous monitoring of logs for signs of database probing is advised until remediation is confirmed.