CVE-2025-10565
📋 TL;DR
Campcodes Grocery Sales and Inventory System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=delete_receiving endpoint via manipulation of the ID parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All users running version 1.0 of this system are affected.
💻 Affected Systems
- Campcodes Grocery Sales and Inventory System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized data access, modification, or deletion of inventory and sales records.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to the affected table.
🎯 Exploit Status
The exploit has been publicly disclosed and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the affected code.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allBlock SQL injection patterns targeting the /ajax.php endpoint with ID parameter manipulation.
Input Validation Filter
allImplement server-side validation to ensure ID parameter contains only numeric values.
🧯 If You Can't Patch
- Restrict network access to the application to trusted IP addresses only.
- Implement database user with minimal permissions (read-only if possible) for the application.
🔍 How to Verify
Check if Vulnerable:
Test the /ajax.php?action=delete_receiving endpoint with SQL injection payloads in the ID parameter (e.g., ID=1' OR '1'='1).Check Version:
Check the application version in the admin panel or configuration files.Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that input validation is properly implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed delete_receiving requests with suspicious ID parameters
Network Indicators:
- HTTP POST/GET requests to /ajax.php with SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/ajax.php" AND (param="ID" AND value MATCHES "'.*OR.*|'.*AND.*|'.*UNION.*")