A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity and access.

This is a SQL injection vulnerability (CWE-89) located in the /pages/us_edit1.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification of inventory records, or potential administrative account takeover within the application. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the underlying database, which may contain sensitive business or user information.

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the vulnerable /pages/us_edit1.php endpoint or disable the affected module entirely if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual activity targeting the /pages/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected systems. Organizations running Campcodes Computer Sales and Inventory System 1.0 must prioritize implementing network-level blocks or WAF rules immediately to prevent unauthorized database access until an official vendor patch is released.