An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

The application fails to properly sanitize the txtCategoryName parameter within the /admin/add_category.php file, allowing unauthenticated remote attackers to inject malicious SQL commands directly into database queries.

Successful exploitation allows an attacker to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of business integrity, and prolonged service disruption.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /admin/add_category.php endpoint and implement strict input validation for all POST requests.

Proactive Monitoring: Monitor database query logs for unusual time-based patterns, such as unexpected sleep commands or large-scale data extraction attempts originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the txtCategoryName parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

The presence of a public proof-of-concept significantly elevates the risk of automated exploitation by malicious actors. Organizations currently running Campcodes Supplier Management System 1.0 are urged to isolate the application from external networks and prioritize the implementation of robust input sanitization or transition to a more secure alternative until a vendor-supplied patch is released.