A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

The application fails to properly sanitize the txtDistributorAddress argument within the /admin/add_distributor.php endpoint. This SQL injection flaw can be triggered by an unauthenticated attacker, potentially allowing unauthorized database manipulation.

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a significant threat to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration or modification within the supplier management database, resulting in potential operational disruption and loss of proprietary information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN authentication to prevent unauthorized requests.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/add_distributor.php, specifically looking for SQL syntax patterns or unusual string lengths in the txtDistributorAddress parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing common SQL injection payloads directed at the vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running Campcodes Supplier Management System 1.0 must implement strict access controls on the administrative interface and deploy WAF rules to mitigate the risk until an official vendor update is released.