CVE-2025-10445 is a high severity flaw in Campcodes Computer Sales and Inventory System 1.0, scored 7.3 by NVD. It allows SQL injection through the Username argument of /pages/us_transac.php?action=add. The record lists no fixed version, so restrict access to the affected page, review the code, and check the vendor for a patch.
What's affected
The record names Campcodes Computer Sales and Inventory System 1.0. The affected code is in /pages/us_transac.php?action=add. The vulnerable input is the Username parameter.
No fixed version appears in the record or in the reference pages I could read. Do not assume a later release is safe. Check the vendor or project page for a patched release, and if none exists, plan on mitigation or replacement. The same product has sibling reports with different entry points: CVE-2025-10435, CVE-2025-10436 and CVE-2025-10446. Fixing one endpoint does not fix the others.
The record says the exploit has been published and may be used. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
First find out whether you run the product at all. Applications like this are usually installed by copying source files to a server, so no package manager records them and a dependency scan may not list them. Gold's free in-browser dependency scan still covers the libraries that sit next to them, and your own asset list is the place to find the application itself.
If you do, look at the code rather than the version number. Search your deployment for the file and the argument:
grep -rn "Username" /path/to/app/pages/us_transac.php
Look for the value being joined into a query string. If you see input concatenated into SQL text, the page is exposed. If it passes through a prepared statement with bound parameters, it is not vulnerable in this way.
Then read your web server access logs for requests to /pages/us_transac.php that carry long, odd or encoded values in Username. A hit does not prove a compromise, but it tells you where to look first. Also check which accounts the page can be reached with. The record scores this as reachable remotely, so treat any internet exposed copy as in scope.
What to do now
- Find every copy of Campcodes Computer Sales and Inventory System 1.0 in your estate, including test and demo servers.
- Take the application off the public internet where you can. Put it behind a VPN, an IP allow list or a reverse proxy with authentication, at least until it is fixed.
- Check the vendor or project page for a patched release and apply it if one exists.
- If you maintain the code, replace string concatenation in /pages/us_transac.php with prepared statements and bound parameters, and validate that Username has the type you expect.
- Make the database account used by the application as limited as it can be. It should not own the schema or read tables it does not need.
- Review logs and the database for unexpected reads or changes since the application went online, and rotate any credentials stored in the database.
- If the product is abandoned and no fix is coming, plan its replacement.
Why it matters
This is SQL injection, listed under CWE-74 (injection), CWE-89 (SQL injection). The application builds a database query by placing the Username value directly into SQL text. The database cannot tell the developer's query apart from the data a visitor typed, so crafted input can change what the query does. Depending on the database account, that can mean reading records the page was never meant to show, changing data, or deleting it.
The fix for this class is well understood: separate code from data with parameterised queries. Small PHP and Go projects are often built by copying one pattern between many pages, which is why one report is rarely the only one. Here that is visible in the sibling CVEs listed above. The score of 7.3 reflects network reach, low complexity and no privileges required, with low impact ratings on confidentiality, integrity and availability in the vector. Those ratings are generic, and the real damage depends on the database account and the data stored.
Quick check
Does a web application firewall fix CVE-2025-10445?
It can reduce noise, but it does not remove the weakness. The query is still built unsafely inside Campcodes Computer Sales and Inventory System 1.0. Fix the code or take the page out of reach.
How do I fix this kind of bug in my own code?
Use prepared statements with bound parameters for every query that takes user input, validate types, and give the database account the least privilege it needs.
Sources
Last reviewed: 19 October 2026.
