A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote, unauthenticated attackers to manipulate database queries, posing a significant risk of unauthorized data access.

The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize the prodcode parameter within the /pages/pro_edit1.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

The vulnerability carries a CVSS score of 7.3, reflecting a high risk due to the lack of required authentication and the potential for direct database manipulation. Successful exploitation could lead to the unauthorized disclosure or modification of sensitive inventory and sales data, resulting in potential data breaches and loss of system integrity.

Immediate Action: Since no official vendor patch is currently confirmed, administrators should restrict access to the /pages/pro_edit1.php endpoint or disable the affected module entirely until a secure update is provided by Campcodes.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /pages/pro_edit1.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to any organization deploying this software. We strongly recommend isolating the application from external networks and applying the vendor patch as soon as it becomes available to prevent unauthorized database access.