CVE-2025-7470 is a high severity unrestricted file upload flaw (CVSS 7.3) in Campcodes Sales and Inventory System version 1.0, reached through the image argument of /pages/product_add.php. The record names no patched release, so the fix is to restrict what the upload accepts, limit access to the app, or retire it.
What's affected
The record names Campcodes Sales and Inventory System, version 1.0. The weak spot is the image argument handled by /pages/product_add.php, which accepts an uploaded file. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That means network reachable, low complexity, no privileges and no user interaction, with a low impact on confidentiality, integrity and availability, for a base score of 7.3.
The description calls the issue critical, while the CVSS base score of 7.3 sits in the High band. This post uses High. Where an upload can lead to code running on the server, your own risk rating may be higher than the score suggests.
No fixed version appears in the record or its references. Treat every copy of version 1.0 as affected until the vendor says otherwise. The record says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Find whether you run the product, then look at what the upload handler accepts and where files land.
find /var/www -type f -name "product_add.php"
grep -n "move_uploaded_file\|\$_FILES" /path/to/product_add.php
Next, list the folder where uploaded images are stored and look for anything that is not an image, in particular files with a script extension such as php.
find /path/to/upload/dir -type f -not \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" \)
Also review web server logs for POST requests to /pages/product_add.php from addresses you do not recognize. If you cannot find the product, run a free scan at gold.safeguard.sh/scan. A hand-written PHP project may not show up in a package inventory, so the file search on the server is the more reliable check.
What to do now
- Find every copy of Campcodes Sales and Inventory System you run, including test servers, and note which face the internet.
- Put internet-facing copies behind a VPN, login proxy or IP allow list, or take them offline, until the code is fixed.
- Make the upload folder unable to run scripts. Serve it from a path where the web server does not execute PHP, or store files outside the web root.
- Change the handler behind /pages/product_add.php to accept only an allow list of image types, check the real file content and not only the extension, and rename files on save.
- Review the upload folder for files that should not be there, and treat any script file as a sign of compromise to investigate.
- Watch the vendor site and the NVD record for a fix, and check the advisory before relying on any claim of a patch. If the product is abandoned, plan a replacement.
- Rescan after changes and keep the app on a recurring check.
Why it matters
The record maps this to CWE-434, unrestricted upload of a file with a dangerous type, and CWE-284, improper access control. When an app lets a visitor store a file of their choosing in a place the server can run, the upload feature stops being a convenience and becomes a way to put content on your server.
The defence has two parts that work together. Validate what comes in, and make sure that what is stored cannot be executed. Either one alone leaves gaps, so do both.
Quick check
Is there a patched version of Sales and Inventory System?
The record and its references do not name one. Check the vendor site and the advisory, and apply the upload restrictions above yourself if you must keep running it.
Does renaming uploaded files fix this?
It helps, but it is not enough alone. Combine an allow list of file types, content checks and a storage location where scripts cannot run.
Sources
The other references in the record are public researcher write-ups and database entries. This post does not reproduce them and gives no attack steps.
Last reviewed: 18 October 2026.
