Read the docs
TI-2026-85268 Aliases CVE-2026-122050GHSA-9759-76w8-jmfj

SQL injection in Campcodes Complete Sales and Inventory System login

Priority HIGH 70CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Campcodes Complete Sales and Inventory System with Credit Management 1.0 contains an SQL injection flaw in the file /ahira/login.php. Improper neutralization of special elements lets a remote attacker manipulate the branch argument to inject SQL commands. The exploit has been made public and could be used.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00263 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CampcodesComplete Sales and Inventory System with Credit Management1.0—No fix listedCNA
  • Complete Sales and Inventory System with Credit Management VendorCampcodes Affected 1.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:campcodes:complete_sales_and_inventory_system_with_credit_management:*:*:*:*:*:*:*:*——Campcodes
  • cpe:2.3:a:campcodes:complete_sales_and_inventory_system_with_credit_management:*:*:*:*:*:*:*:* Versions — — ·Campcodes

Remediation

The sources list no fixed version for Complete Sales and Inventory System with Credit Management.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122050
  2. 2026-11-05 Alias added: GHSA-9759-76w8-jmfj
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 1

  • TI-2024-23142 A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based… CVSS 3.1CRITICAL 9.8
  • TI-2024-23141 A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete… CVSS 3.1CRITICAL 9.8
  • TI-2024-23137 A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete… CVSS 3.1CRITICAL 9.8
  • TI-2024-22318 A SQL injection vulnerability in /model/get_timetable.php in campcodes Complete Web-Based… CVSS 3.1CRITICAL 9.8
  • TI-2024-22316 A SQL injection vulnerability in /model/get_grade.php in campcodes Complete Web-Based… CVSS 3.1CRITICAL 9.8
  • TI-2024-22315 A SQL injection vulnerability in /model/get_student.php in campcodes Complete Web-Based… CVSS 3.1CRITICAL 9.8
See all 633 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences