EUVD-2025-21263CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pages/receipt_credit.php. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7536 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the /pages/receipt_credit.php endpoint via the 'sid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, indicating active exploitation risk.
Technical Context
The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output ['Injection']) stemming from insufficient input validation and parameterization in the receipt_credit.php script. The 'sid' parameter is directly concatenated into SQL queries without proper escaping or prepared statements. Campcodes Sales and Inventory System is a web-based inventory management application, likely built on PHP/MySQL architecture. CPE identification would be 'cpe:2.3:a:campcodes:sales_and_inventory_system:1.0:*:*:*:*:*:*:*'. The root cause reflects legacy coding practices where user input is trusted without sanitization, a well-understood and preventable class of vulnerabilities.
Affected Products
[{'vendor': 'Campcodes', 'product': 'Sales and Inventory System', 'versions': ['1.0'], 'cpe': 'cpe:2.3:a:campcodes:sales_and_inventory_system:1.0:*:*:*:*:*:*:*', 'affected_component': '/pages/receipt_credit.php', 'vulnerable_parameter': 'sid'}]
Remediation
[{'type': 'Patch', 'description': 'Upgrade to patched version (patch version not specified in disclosure; contact Campcodes for availability). Check vendor advisories at Campcodes official channels.', 'priority': 'Immediate'}, {'type': 'Workaround - Input Validation', 'description': "Implement strict input validation on the 'sid' parameter: whitelist numeric values only (if sid is expected to be an integer), reject special SQL characters, and enforce length limits.", 'priority': 'Urgent'}, {'type': 'Workaround - Parameterized Queries', 'description': 'Refactor receipt_credit.php to use prepared statements with parameterized queries instead of string concatenation. Example: Use mysqli prepared statements or PDO with bound parameters.', 'priority': 'Urgent'}, {'type': 'Mitigation - Network Controls', 'description': 'Restrict network access to receipt_credit.php endpoint via firewall/WAF rules. Implement rate limiting and anomaly detection. Deploy Web Application Firewall (WAF) rules to block SQL injection patterns.', 'priority': 'High'}, {'type': 'Mitigation - Database Hardening', 'description': 'Apply principle of least privilege to database user accounts serving the application. Limit database user permissions to only necessary tables/operations. Disable error messages that reveal database structure.', 'priority': 'High'}, {'type': 'Monitoring', 'description': 'Enable query logging and monitor for suspicious SQL patterns. Implement intrusion detection to flag SQL keywords in request parameters.', 'priority': 'Medium'}]
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today