CVE Alert: CVE-2025-11039 – Campcodes – Computer Sales and Inventory System

Risk verdict

High risk: remote SQL injection with a publicly disclosed PoC and an automatable exploit path; treat as a priority for remediation.

Why this matters

An attacker can target an internet-facing instance to exfiltrate or modify data, or disrupt availability, without credentials or UI interaction. In a retail/inventory context, the attacker could access customer or stock data, alter records, or cause partial service outages, impacting trust and operations.

Most likely attack path

An external actor probes the vulnerable us_edit1.php endpoint, supplying crafted ID values to trigger SQL injection. With no privileges or user interaction required, the query manipulation can yield data leakage or data integrity impact, and could enable broader database access if the backend DB is reachable from the app tier.

Who is most exposed

Retailers and small businesses running Campcodes Computer Sales and Inventory System 1.0 with web-facing deployments are most at risk, especially where the web app sits on public networks or exposes admin-like pages to the internet.

Detection ideas

• Web server/access logs showing requests to us_edit1.php with suspicious ID payloads (e.g., quotes, OR conditions, UNION SELECT).
• Database or application logs containing SQL error messages or unusual syntax from the vulnerable endpoint.
• WAF alerts targeting SQLi patterns on the affected path.
• Repeated 500/500+ errors from the page following unusual input.
• Unexplained data access patterns (unexpected table reads) or inventory changes.

Mitigation and prioritisation

• Apply vendor patch or upgrade to fixed version; if unavailable, implement strong input handling and migrate to parameterised queries or stored procedures.
• Enforce compensating controls: web application firewall rules for SQLi patterns; disable or tightly restrict access to the vulnerable endpoint; network-level access controls to minimise exposure.
• Improve authentication and least-privilege: ensure DB accounts used by the app have minimal privileges; restrict the vulnerable page to approved networks where possible.
• Change-management: test patches in staging, then deploy with monitoring; review logs for indicators of exploitation during rollout.
• If KEV or EPSS were known as high, escalate to Priority 1; current data does not confirm that, so treat as high-priority remediation.