The Campcodes Supplier Management System 1.0 is vulnerable to unauthenticated SQL injection, which could lead to complete database compromise and unauthorized data access.

This is a SQL injection vulnerability (CWE-89) located in the /admin/add_retailer.php file. The application fails to sanitize the cmbAreaCode POST parameter, allowing unauthenticated attackers to inject malicious SQL commands directly into the backend database.

Successful exploitation allows an attacker to bypass authentication mechanisms, leak sensitive data, modify database contents, or potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, regulatory non-compliance, and disruption of business operations.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/add_retailer.php endpoint using network-level controls or by disabling the affected module.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the add_retailer.php file, particularly those containing SQL syntax characters like single quotes, dashes, or SQL keywords such as SELECT and SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the cmbAreaCode parameter.

Public Exploit Available: Yes, a public proof-of-concept is documented in the researcher's GitHub repository.

The presence of a public proof-of-concept combined with the lack of authentication required for exploitation makes this a significant risk. Organizations utilizing Campcodes Supplier Management System must treat this as a high-priority item. Implement the recommended compensating controls immediately and monitor for unauthorized access until the vendor provides a formal security update.