Campcodes Point of Sale System 1.0 is vulnerable to an unauthenticated SQL injection attack that could lead to unauthorized database access and potential system compromise.

This is a SQL injection (CWE-89) vulnerability located in the login.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database. This could result in the unauthorized extraction of sensitive business data, such as customer records or login credentials, and may facilitate further attacks against the underlying server infrastructure. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the point of sale environment.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the login portal using IP whitelisting or VPN requirements to prevent unauthorized exposure.

Proactive Monitoring: Monitor web server access logs for anomalous requests to login.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced at the Yuque security portal.

Due to the lack of an official patch and the public availability of a proof-of-concept, this vulnerability poses an immediate threat to organizations using Campcodes Point of Sale System 1.0. Organizations should prioritize implementing network-level access controls and WAF protections immediately. Continuous monitoring for suspicious login attempts is mandatory until a vendor-supplied update is verified and applied.