CVE-2025-10413
📋 TL;DR
This vulnerability allows remote attackers to execute SQL injection attacks against Campcodes Grocery Sales and Inventory System 1.0 via the /ajax.php?action=delete_customer endpoint. Attackers can manipulate the ID parameter to execute arbitrary SQL commands, potentially compromising the database. All users running version 1.0 of this software are affected.
💻 Affected Systems
- Campcodes Grocery Sales and Inventory System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, customer information theft, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the /ajax.php file, specifically for the delete_customer action.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests to /ajax.php
Input Validation Filter
allAdd server-side validation to only accept numeric values for the ID parameter
Modify /ajax.php to include: if(!is_numeric($_GET['ID'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Isolate the system from the internet and restrict access to authorized users only
- Implement database-level protections: use least privilege accounts, enable audit logging, and regularly monitor for suspicious queries
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /ajax.php?action=delete_customer&ID=1' OR '1'='1Check Version:
Check the software version in the admin panel or configuration filesVerify Fix Applied:
Test with the same payloads and verify they are rejected or properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed delete_customer requests with SQL syntax in parameters
- Database queries with UNION, SELECT, or other SQL injection patterns
Network Indicators:
- HTTP requests to /ajax.php with SQL keywords in parameters
- Unusual traffic patterns to the delete_customer endpoint
SIEM Query:
source="web_logs" AND uri_path="/ajax.php" AND (query_string="*delete_customer*" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR*1*"))