EUVD-2025-18723
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/cash_transaction.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6312 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/cash_transaction.php file where the 'cid' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploitation details available, making it actively exploitable in the wild.
Technical Context
This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection (a subset of injection attacks). The affected application is Campcodes Sales and Inventory System 1.0, a web-based inventory management platform written in PHP. The vulnerability exists in the cash_transaction.php page handler, where user-supplied input from the 'cid' parameter is directly concatenated into SQL queries without proper parameterized statements or input validation. The application likely uses PHP with a database backend (MySQL/MariaDB or similar), and the lack of prepared statements or ORM protection allows an attacker to break out of the intended SQL context and inject arbitrary SQL commands.
Affected Products
- product: Campcodes Sales and Inventory System; version: 1.0; vendor: Campcodes; affected_component: /pages/cash_transaction.php; vulnerable_parameter: cid; cpe: cpe:2.3:a:campcodes:sales_and_inventory_system:1.0:*:*:*:*:*:*:*
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today