COMPLETE SALES AND INVENTORY SYSTEM WITH CREDIT MANAGEMENT · CVE-2026-122050 · Other
NO FIX YET
The login handler in /ahira/login.php puts the POST field 'branch' into its SQL query without escaping (username and password are escaped). TraceX Labs reproduced in a local lab that branch=x' OR '1'='1 with a wrong password gives an admin session and access to /pages/home.php, so no credentials are needed. The researcher's CVSS 3.1 score is 8.6.
first public Nov 5, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running Campcodes Complete Sales and Inventory System with Credit Management 1.0 whose login page can be reached over a network. The researcher shows an unauthenticated attacker can log in as an existing user, including the admin, and so reach sales, inventory, customer and payment records. Installations of other software can skip it.
Not affected if login-page-not-exposed, product-not-installed
Who cares auth-bypass, campcodes, php, self-hosted, sql-injection
branch] used directly in the login query (branch_id=$branch) without mysqli_real_escape_string or a prepared statementNo fix yet, per the sources.
A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.