CVE Alert: CVE-2025-9761 – Campcodes – Online Feeds Product Inventory System

Risk verdict

High risk: remote SQL injection on the login component with public disclosure; watch for active exploitation or mass probing.

Why this matters

The vulnerability permits unauthenticated access to the underlying database through the login flow, risking data exposure, modification of inventory records, and potential further compromise of connected systems. With public exploitation guidance available, opportunistic attackers may scan internet-facing instances and automate attempts to exfiltrate or corrupt data.

Most likely attack path

An attacker targets the /feeds/index.php login endpoint, supplying crafted Username input to induce SQL injection. No user interaction or credentials are required, and exploitation can disclose or alter data at the database level. If the database is reachable from the application or if the query results leak, attackers may pivot to broader data access while remaining within the compromised application context.

Who is most exposed

Any organisation running Campcodes’ Online Feeds Product Inventory System v1.0 with a publicly reachable login page is at risk, especially small- to medium-sized deployments on internet-exposed servers or low-segmentation environments.

Detection ideas

• Alerts for SQL error messages or anomalous responses from the login endpoint.
• Logs showing injection-like payloads or unusual Unicode/escape patterns in Username.
• Sudden spikes in login attempts from diverse IPs or unusual query results in DB logs.
• IDS/IPS signatures or WAF alerts targeting SQLi payloads on /feeds/index.php.
• Unusual data access or modification events in the inventory database.

Mitigation and prioritisation

• Apply vendor patch or updated build addressing the SQL injection (prerequisite: confirm availability).
• If no patch yet, implement input validation and parameterised queries; enforce least privilege for the app DB account.
• Enable WAF rules specifically for SQLi on the login endpoint; restrict exposure of the login interface where feasible.
• Network segmentation and disable broad internet exposure of the login page until mitigated.
• Monitor: implement enhanced logging for login traffic and perform a targeted remediation window.