CVE-2026-122050: Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection
A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely without authentication or user interaction. An attacker needs to send a crafted value in the branch argument to /ahira/login.php.
Is exploitation likely to be practical?
A public exploit is available, and the reported attack complexity is low. Systems exposing the affected login endpoint to untrusted networks are therefore at particular risk.
How can I determine whether my deployment is affected?
Check whether you run Campcodes Complete Sales and Inventory System with Credit Management version 1.0 and expose /ahira/login.php. Review web and application logs for unusual requests to that path containing SQL-injection-like values in the branch parameter.