An unauthenticated SQL injection vulnerability in Campcodes Online Feeds Product Inventory System 1.0 poses a significant risk of unauthorized database manipulation.

This vulnerability is a SQL injection flaw (CWE-89) located in the /feeds/index.php file. An unauthenticated attacker can exploit this by manipulating the Username parameter to execute arbitrary SQL commands.

Successful exploitation allows an attacker to interact directly with the underlying database, which may lead to unauthorized data disclosure, modification, or potential administrative bypass. While the CVSS score of 7.3 indicates a high severity, the ability for an unauthenticated user to perform these actions remotely makes this a primary target for automated exploitation.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /feeds/index.php endpoint or disable the vulnerable component entirely until a fix is released by the vendor.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically focusing on SQL syntax characters like single quotes, dashes, or UNION statements within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to block SQL injection attempts against the identified vulnerable parameter to provide a temporary virtual patch.

Public Exploit Available: Yes — a published proof-of-concept exists via the GitHub repository referenced in the vulnerability disclosure.

Given the public availability of exploit material and the lack of a vendor patch, organizations utilizing this system must prioritize immediate mitigation. Restricting network access to the application and implementing WAF protections are essential to prevent potential compromise of the backend database until the vendor provides an official security update.