An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /admin/add_area.php script, where the txtAreaCode parameter fails to sanitize user input. The flaw is exploitable by unauthenticated remote attackers who can inject malicious SQL commands directly into the application database.

Successful exploitation of this vulnerability allows unauthorized actors to access, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete loss of data confidentiality and integrity, potentially resulting in regulatory non-compliance and significant operational disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/add_area.php endpoint to authorized internal network segments only.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as the use of sleep commands or unexpected syntax, which may indicate active SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the txtAreaCode parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Due to the lack of an official patch and the public availability of exploit code, this vulnerability poses a credible and elevated risk to deployments of the Campcodes Supplier Management System. Organizations should prioritize isolating the affected application from public-facing networks until the vendor provides a secure update that implements prepared statements and rigorous input validation.