EUVD-2025-21267Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/product_update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.
Technical ContextAI
The vulnerability exists in a PHP-based web application (Campcodes Sales and Inventory System) that fails to properly sanitize or parameterize user input in the ID parameter passed to product_update.php. This is a classic CWE-74 (Improper Neutralization of Special Elements in Output) / SQL Injection scenario where untrusted input is directly concatenated into SQL queries without prepared statements or proper escaping. The affected file processes product update requests, likely querying a backend database (MySQL/MariaDB typical in PHP applications) using dynamically constructed queries. The lack of input validation allows attackers to break out of the intended SQL syntax and inject malicious SQL commands.
RemediationAI
Immediate actions: (1) Update Campcodes Sales and Inventory System to a patched version if available from the vendor (check vendor website for version 1.1 or later security releases); (2) If no patch exists, implement immediate compensating controls: apply Web Application Firewall (WAF) rules to block SQL injection patterns in the ID parameter (regex: detect quotes, SQL keywords like UNION, OR, semicolons); (3) Enforce prepared statements/parameterized queries in product_update.php code; (4) Implement input validation whitelisting for ID parameter (numeric-only if IDs are integers); (5) Apply principle of least privilege to database user accounts (read-only where possible); (6) Enable comprehensive SQL error logging and monitoring. Contact Campcodes support directly for vendor-specific patch availability and timeline.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today