CVE-2025-10415
📋 TL;DR
Campcodes Grocery Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=save_supplier endpoint via manipulation of the ID parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All users running version 1.0 of this software are affected.
💻 Affected Systems
- Campcodes Grocery Sales and Inventory System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, modification of inventory/supplier records, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only read access to non-sensitive data.
🎯 Exploit Status
Exploit details publicly available on GitHub; simple parameter manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize ID parameter before processing
Modify /ajax.php to validate ID parameter as integer using is_numeric() or similar
Web Application Firewall
allDeploy WAF with SQL injection rules to block malicious requests
🧯 If You Can't Patch
- Restrict network access to the application to trusted IPs only
- Implement database user with minimal privileges (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Send test request to /ajax.php?action=save_supplier with ID parameter containing SQL injection payload (e.g., ID=1' OR '1'='1)Check Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Test with same payload after implementing fixes; should return error or no database interaction📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /ajax.php with unusual ID parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) in ID parameter
SIEM Query:
source="web_logs" AND uri="/ajax.php" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR*1=1*")