A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated attackers to execute arbitrary database queries, posing a severe risk to data integrity and system confidentiality.

The application fails to properly sanitize the chkId[] parameter within the /admin/view_unit.php file before using it in SQL queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access.

Successful exploitation permits attackers to bypass security controls to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this vulnerability represents a high risk that could lead to full database compromise, unauthorized administrative actions, and significant business disruption.

Immediate Action: As no official vendor patch is currently identified, administrators should restrict access to the affected endpoint at the network or web server level. Disable the vulnerable functionality if it is not business-critical until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /admin/view_unit.php, specifically monitoring for anomalous character strings or time-based delay patterns indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters. Additionally, ensure the application connects to the database using an account with the least privilege necessary to limit the potential impact of an exploit.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a publicly available proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using Campcodes Supplier Management System should prioritize implementing the suggested compensating controls immediately to prevent unauthorized database access while awaiting further guidance or a patch from the vendor.