CVE Alert: CVE-2025-10563 – Campcodes – Grocery Sales and Inventory System

Risk verdict

High risk: remote SQL injection with a publicly disclosed PoC, enabling attacker access without credentials.

Why this matters

An attacker could read or modify database content, potentially exposing customer data and inventory records. The flaw’s remote nature combined with a PoC increases the window for automated exploitation and may enable downstream disruption of operations.

Most likely attack path

Attacker can target the publicly accessible /ajax.php?action=save_category endpoint without authentication (network vector, low complexity, no UI interaction). Successful injection could leak or alter data (C and I impacts shown as limited) with no privilege escalation required and a single scope change risk, enabling targeted data exfiltration or tampering in the affected store’s DB.

Who is most exposed

Small to medium retail deployments running Campcodes Grocery Sales and Inventory System v1.0 with publicly reachable web interfaces—often on on-prem or inexpensive hosting—are most at risk, especially if they lack prompt patching and secure DB credentials.

Detection ideas

• Logs show SQL error messages or abnormal responses from ajax.php?action=save_category.
• Suspicious requests with crafted id parameters triggering anomalies (e.g., unusual length or payloads).
• Increased 500/502 or SQL error codes for the endpoint.
• WAF alerts for SQLi signatures in this path.
• DB user activity spikes from the web app account.

Mitigation and prioritisation

• Apply any available patch or upgrade to a non-vulnerable release; implement vendor-supplied fixes promptly.
• Implement input validation and use prepared statements / parameterised queries in the affected code path.
• Enforce least privilege for the web app’s DB user; disable unnecessary DB features.
• Add Web Application Firewall rules to block SQLi payloads targeting this endpoint; monitor for repeated attempts.
• Change-management: test fixes in a staging environment before production; document remediation timing. If KEV is true or EPSS ≥ 0.5, treat as priority 1.