A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /manufacturer/confirm_order.php file. An unauthenticated attacker can exploit this by manipulating the ID parameter to execute arbitrary SQL commands.

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive supplier or order information stored within the application database. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data exfiltration or database compromise.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected file or disable the vulnerable module until the vendor releases a security update.

Proactive Monitoring: Review application and database logs for suspicious SQL syntax, such as unexpected UNION, SELECT, or sleep commands, specifically targeting the confirm_order.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns and sanitize input for all HTTP requests targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of an official patch, the risk of exploitation is elevated. Organizations currently running Campcodes Supplier Management System 1.0 must prioritize isolating the affected system from external networks and implementing strict WAF filtering to mitigate the threat until a vendor-supplied update is available.