CVE Alert: CVE-2025-10416 – Campcodes – Grocery Sales and Inventory System
CVE-2025-10416
HIGHNo exploitation knownPoC observed
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_supplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS v3.1 (7.3)
Vendor
Campcodes
Product
Grocery Sales and Inventory System
Versions
1.0
CWE
CWE-89, SQL Injection
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Published
2025-09-14T23:32:06.914Z
Updated
2025-09-15T17:16:32.387Z
References
AI Summary Analysis
Risk verdict
Why this matters
Most likely attack path
Who is most exposed
Detection ideas
- Alerts for suspicious ID values targeting delete_supplier
- SQL error messages or stack traces in application or DB logs
- Anomalous data modifications in supplier/history tables
- WAF logs showing SQLi patterns on ajax.php?action=delete_supplier
- Unusual spikes in 500s or DB query latency after specific requests
Mitigation and prioritisation
- Patch to fixed version; migrate to parameterised queries/prepared statements
- Validate and canonicalise ID inputs; implement allowlists
- Enforce least-privilege DB user for the web app; restrict delete operations to authenticated actions
- Add authentication/CSRF protections for the endpoint; consider IP allowlisting
- Enable detailed monitoring and DB query auditing; implement targeted WAF rules
- Change-management: test in staging, implement rapid deployment plan; have rollback ready
- Prioritisation: treat as priority 1 if KEV true or EPSS ≥ 0.5; otherwise, escalate promptly and patch immediately due to PoC/public exploitability.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
