The Campcodes Online Water Billing System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection (CWE-89) flaw located in the addclient1.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the lname parameter.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive billing and client data stored within the backend database. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially resulting in the exfiltration of personally identifiable information or system compromise.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and disable the vulnerable addclient1.php functionality if it is not business-critical.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that may indicate injection attempts, specifically targeting traffic directed at the addclient1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly those targeting the lname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, this vulnerability should be treated with high priority. Organizations using the Campcodes Online Water Billing System must implement restrictive network controls and WAF filtering immediately to mitigate the risk of unauthorized database access while awaiting a formal security update from the vendor.