A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

The application is susceptible to SQL injection via the cash or firstname arguments within the /pages/pos_transac.php?action=add endpoint. This flaw allows unauthenticated remote attackers to inject malicious SQL commands into the backend database.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive customer or inventory records, potential data exfiltration, or modification of transaction history, resulting in significant operational and reputational damage. The CVSS score of 7.3 reflects the high risk associated with remote, unauthenticated access to the database layer.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable endpoint if not required for business operations.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the cash and firstname parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the specified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical reference provided by the researcher (https://github.com/e1evensu/cve/issues/1).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Computer Sales and Inventory System must prioritize hardening the application environment and implementing strict input validation or WAF rules to prevent unauthorized database interaction until a vendor-supplied patch is issued.