{"id":"CVE-2026-122050","kind":"vulnerability","aliases":["CVE-2026-122050"],"related":[],"title":"Campcodes Sales and Inventory System 1.0: login page SQL injection lets anyone log in as admin","description":"A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.","summary":"The login handler in /ahira/login.php puts the POST field 'branch' into its SQL query without escaping (username and password are escaped). TraceX Labs reproduced in a local lab that branch=x' OR '1'='1 with a wrong password gives an admin session and access to /pages/home.php, so no credentials are needed. The researcher's CVSS 3.1 score is 8.6.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Complete Sales and Inventory System with Credit Management","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-bypass","campcodes","other","php","self-hosted","sql-injection"],"not_affected_if":["login-page-not-exposed","product-not-installed"],"how_to_check":"Find out whether Campcodes Complete Sales and Inventory System with Credit Management 1.0 is installed and /ahira/login.php is reachable. In that file, look for $branch=$_POST['branch'] used directly in the login query (branch_id='$branch') without mysqli_real_escape_string or a prepared statement. Check web logs for POSTs to login.php whose branch value contains quotes or SQL keywords.","fix":null,"status":"open","published_at":"2026-11-05T00:17:23+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","triaged_at":"2026-11-05T00:31:51+00:00","updated_at":"2026-11-05T00:33:11+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-05T00:31:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Campcodes Sales and Inventory System: SQL injection in login page","impact":"high","summary":"Complete Sales and Inventory System with Credit Management 1.0 has an SQL injection flaw in its /ahira/login.php file via the branch argument. A remote attacker can manipulate that input to read or alter the application's database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["campcodes","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads or changes the application database remotely","analyst_note":"Confirm the affected versions and any vendor fix at https://nvd.nist.gov/vuln/detail/CVE-2026-122050; the sources only name version 1.0.","how_to_check":"- Check whether the application is installed and whether `/ahira/login.php` is reachable on your server\n- unknown for version-specific checks, as the sources only name version 1.0","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-installed"],"who_is_affected":"Organisations that run the Campcodes Complete Sales and Inventory System with Credit Management 1.0 and expose its login page to a network. The sources describe the flaw as reachable remotely, and the exploit is public. Installations not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4232,"output_tokens":511,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected versions and any vendor fix at https://nvd.nist.gov/vuln/detail/CVE-2026-122050; the sources only name version 1.0.","search":"'-122050':19A,22A '-2026':18A,21A '/ahira/login.php':47B,126C '/pages/home.php':88B '1':75B,76B '1.0':6A,116C '3.1':98B '8.6':101B 'access':86B 'admin':16A,83B 'affect':119C 'and':25A 'anyon':12A 'argument':132C 'attack':139C 'auth':32B 'auth-bypass':31B 'branch':52B,72B,133C 'bypass':33B 'campcod':1A,34B,107C 'carri':144C 'complet':108C 'complete':23A 'could':154C 'credenti':91B 'credit':29A,114C 'cve':17A,20A 'cvss':97B 'escap':58B,63B 'exploit':148C 'field':51B 'file':125C 'found':105C 'give':81B 'handler':45B 'host':39B 'inject':10A,42B,137C 'inventori':4A,111C 'inventory':26A 'issu':118C 'lab':65B,70B 'let':11A 'local':69B 'log':13A 'login':7A,44B 'made':151C 'manag':115C 'management':30A 'manipul':129C 'need':93B 'page':8A 'password':61B,80B 'perform':127C 'php':36B 'possibl':141C 'post':50B 'process':122C 'public':152C 'put':48B 'queri':56B 'remot':146C 'reproduc':66B 'research':95B 'result':134C 'sale':2A,109C 'sales':24A 'score':99B 'self':38B 'self-host':37B 'session':84B 'sql':9A,41B,55B,136C 'sql-inject':40B 'system':5A,27A,112C 'tracex':64B 'unknown':121C 'use':156C 'usernam':59B 'vulner':103C 'with':28A 'without':57B 'wrong':79B 'x':73B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Campcodes Complete Sales and Inventory System with Credit Management 1.0 whose login page can be reached over a network. The researcher shows an unauthenticated attacker can log in as an existing user, including the admin, and so reach sales, inventory, customer and payment records. Installations of other software can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["completesalesandinventorysystemwithcreditmanagement","salesandinventorysystemwithcreditmanagement"],"ptokens":["and","complete","credit","inventory","management","sales","system","with"],"labels":["authbypass","campcodes","high","other","php","selfhosted","sqlinjection"],"campaign_type":null,"first_public_at":"2026-11-05T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-122050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122050","severity":null,"published_at":"2026-11-05T00:17:23+00:00","modified_at":"2026-11-05T00:17:23+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","fetched_at":"2026-11-05T00:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122050:1735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122050","severity":null,"published_at":"2026-11-05T00:33:11+00:00","modified_at":"2026-11-05T00:33:11+00:00","first_seen_at":"2026-11-05T00:33:11+00:00","fetched_at":"2026-11-05T00:33:11+00:00","note":"NVD (VulDB CNA) plus TraceX Labs write-up with PoC (lab-reproduced pre-auth auth bypass). No vendor advisory or fix found; the researcher's page said vendor not notified, so fix left unknown. Nothing marked verified (no vendor source). Workaround: cast branch to int / use prepared statements (researcher's remediation).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122050","https://tracexlabs.com/releases/campcodes-complete-sales-and-inventory-system-login-sqli.html"]}],"documents":[{"id":71614,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122050","title":"NVD CVE-2026-122050","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":71615,"url":"https://tracexlabs.com/releases/campcodes-complete-sales-and-inventory-system-login-sqli.html","title":"TraceX Labs: Pre-auth SQLi auth bypass in CampCodes Sales and Inventory System 1.0","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://tracexlabs.com/releases/campcodes-complete-sales-and-inventory-system-login-sqli.html"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}