Campcodes Sales and Inventory System 1.0. has a high severity SQL injection flaw, CVE-2025-4741, scored 7.3 by CVSS. It sits in /pages/purchase_add.php and is triggered through the ID parameter. The sources name no patched version, so limit exposure now and correct the query in your copy.
What's affected
The record lists Campcodes Sales and Inventory System version 1.0.. Sales and Inventory System is a PHP application for sales, stock and customer records. The weak spot is the file /pages/purchase_add.php, and the parameter named in the record is ID.
The record does not name a fixed version. The reference list holds a public issue report and the vendor homepage, and neither one, as far as the record shows, points to a patched release. Treat every copy of version 1.0. as affected until the vendor says otherwise, and check the vendor site for a newer download before you rely on this post.
How to check if you're exposed
Start by finding out whether you run this application at all. These apps are often installed once by one person and then forgotten, so look at web roots, not only at your asset list.
find /var/www -name "purchase_add.php" 2>/dev/null
grep -rn "ID" --include="purchase_add.php" /var/www 2>/dev/null
Then look at who can reach it. If the web server is open to the internet, assume the flaw is reachable. The record sets privileges required to none, which means the flaw can be reached without an account.
Check your access logs for requests to the file. Unusual values in the ID parameter, very long values, or a burst of requests from one address are worth a closer look.
grep -c "purchase_add.php" /var/log/nginx/access.log
Adjust the log path to your server. If you cannot tell, open the file and see whether the parameter is placed straight into a query string.
What to do now
- Find every copy of Sales and Inventory System 1.0. that you run, including test and staging copies.
- Take the app off the public internet. Put it behind a VPN, an IP allowlist or a login at the web server.
- Check the vendor site for a newer release and read its notes. If none exists, plan to fix the code yourself or retire the app.
- Change the query in
/pages/purchase_add.phpto use prepared statements with bound parameters, and validate the type ofID. - Give the database account used by the app only the rights it needs, and rotate its password if you saw suspicious requests.
- Review the logs and the database for changes you did not make.
Why it matters
The record maps this to CWE-89, SQL injection, and the parent class CWE-74, injection. The cause is the oldest one in web security: a value from the request is joined to a SQL statement as text, so the database cannot tell data from instructions. Prepared statements keep the two apart.
The score of 7.3 reflects a network attack that needs no account and no user action, with limited impact on confidentiality, integrity and availability. That is a real risk for any app that stores visitor, customer or student records. The record says the exploit has been disclosed to the public. This CVE is not on the CISA Known Exploited Vulnerabilities list, and nothing here says it is exploited in the wild.
Many apps of this kind carry several flaws of the same shape, because the same coding habit repeats across files. Fixing one parameter and leaving the rest is a weak answer. Search the whole code base for queries built from request values.
Quick check
Is there a patched version of Sales and Inventory System?
The record and the public report do not name one. Check the vendor site for a newer release, and treat version 1.0. as affected until you confirm a fix.
Is CVE-2025-4741 being exploited in the wild?
The record says the exploit has been disclosed publicly, but the CVE is not in the CISA Known Exploited Vulnerabilities list. Treat it as likely to be tried against any exposed copy.
If you want a fast look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan lists known issues in a manifest, and the Gold directory has a page for each CVE.
Sources
Last reviewed: 18 October 2026.
