A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to unauthorized database manipulation by remote attackers.

This flaw is a SQL injection vulnerability (CWE-89) located in the /pages/inv_edit1.php file. An unauthenticated remote attacker can inject malicious SQL commands via the idd parameter to manipulate database queries.

The ability to perform SQL injection poses a severe risk to the confidentiality, integrity, and availability of stored data. With a CVSS score of 7.3, this high-severity vulnerability could allow an attacker to bypass authentication, exfiltrate sensitive customer or inventory data, or potentially modify backend database records, leading to significant operational disruption and data loss.

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the affected web interface and implement strict input validation on the idd parameter within inv_edit1.php.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /pages/inv_edit1.php endpoint, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to protect the vulnerable endpoint until a formal vendor update is released.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to affected environments. Organizations currently using version 1.0 of the Campcodes Computer Sales and Inventory System should prioritize isolating the application and applying the recommended WAF protections immediately to prevent potential unauthorized database access.