An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise the underlying database, posing a critical risk to data integrity.

The application fails to properly sanitize the chkId[] parameter within the /admin/view_products.php file before incorporating it into SQL queries. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands, resulting in unauthorized database access and potential data manipulation.

Successful exploitation of this vulnerability can result in full unauthorized access to the application database, leading to the exfiltration of sensitive supplier or administrative data. Given the CVSS score of 7.3, this represents a high-severity risk that could cause significant reputational damage, regulatory non-compliance, and complete loss of confidentiality regarding internal business operations.

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the /admin/view_products.php endpoint to authorized IP addresses only or disable the affected module if it is not business critical.

Proactive Monitoring: Monitor database access logs for unusual query patterns, specifically looking for time-based blind injection attempts or unexpected use of sleep functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the chkId[] parameter.

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub security issue.

The presence of a publicly available proof-of-concept increases the likelihood of opportunistic exploitation. Organizations currently running Campcodes Supplier Management System 1.0 must prioritize the implementation of strict input validation and access controls immediately, as the lack of a vendor-supplied patch necessitates robust manual mitigation strategies to prevent unauthorized database compromise.