A flaw in the edit_profile.php script of Campcodes Supplier Management System version 1.0 allows an attacker to alter the txtRetailerAddress parameter, injecting arbitrary SQL. The operation is performed remotely and can be exploited via a crafted URL or form submission. The flaw is an injection vulnerability (CWE‑74 and CWE‑89). When successfully exploited, attackers can read or modify the database, potentially accessing sensitive information or corrupting inventory data.

Campcodes Supplier Management System, version 1.0, is affected. The vulnerability resides in the /retailer/edit_profile.php module of this system.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% signals a very low probability that the vulnerability is commonly exploited, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a crafted request that manipulates the txtRetailerAddress value, taking advantage of the lack of input validation. Although published exploits exist, the overall risk to environments that have not applied mitigations remains moderate due to the low exploitation likelihood.