A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to remote unauthorized database manipulation.

This is a SQL injection vulnerability occurring within the /pages/us_edit.php script, triggered by manipulating the ID parameter. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation of this flaw allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exposure or modification. Given the CVSS score of 7.3, this represents a high risk to the confidentiality and integrity of business records stored within the inventory system.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or place the application behind a robust Web Application Firewall (WAF) configured to block SQL injection patterns.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /pages/us_edit.php file, specifically monitoring for SQL syntax characters such as single quotes or comment sequences in the ID parameter.

Compensating Controls: Implement strict input validation and parameterized queries in the source code to neutralize the injection vector, and ensure the database user account used by the application has the minimum necessary privileges.

Public Exploit Available: Yes, a published proof of concept exists as documented in the linked GitHub repository.

The presence of a publicly available proof of concept elevates the risk of this vulnerability significantly. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must treat this as a high priority, applying network-level restrictions immediately until a vendor-supplied patch is released.