CVE-2025-10446
📋 TL;DR
This SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows attackers to manipulate database queries through the /pages/cust_searchfrm.php endpoint. Attackers can potentially read, modify, or delete database contents, and the attack can be performed remotely without authentication. All users running version 1.0 of this system are affected.
💻 Affected Systems
- Campcodes Computer Sales and Inventory System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Public exploit available on GitHub; SQL injection via ID parameter manipulation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and apply. 3. Test functionality after patching.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
Input Validation Filter
allImplement input validation to sanitize ID parameter before processing.
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /pages/cust_searchfrm.php?action=edit with SQL injection payloads in ID parameter.Check Version:
Check system documentation or admin panel for version information.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Requests with SQL keywords in ID parameter
Network Indicators:
- HTTP requests to /pages/cust_searchfrm.php with suspicious ID values
- Outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/pages/cust_searchfrm.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "OR 1=1")