An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

This vulnerability is a classic SQL injection (CWE-89) triggered by improper sanitization of the txtunitDetails argument within the /admin/add_unit.php script. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing them to manipulate database queries directly.

Successful exploitation of this flaw enables an attacker to read, modify, or delete sensitive information stored within the application database. Given the CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exfiltration or complete loss of database confidentiality and integrity. The ability for unauthenticated remote access significantly increases the likelihood of a successful breach.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the /admin/add_unit.php endpoint or disable the affected module entirely until a security update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing SQL syntax patterns targeting the /admin/add_unit.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing malicious SQL injection payloads directed at the vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue reported in the exploit references.

Due to the presence of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents an immediate risk to the environment. Organizations currently utilizing Campcodes Supplier Management System version 1.0 must prioritize isolating the affected application from public-facing networks until a vendor-supplied patch is applied. Consistent monitoring for unauthorized database activity is essential to identify potential compromise attempts.