CVE-2025-13424
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability was found in Campcodes Supplier Management System 1.0 in /admin/add_product.php. Manipulating the txtProductName argument leads to SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could remotely execute SQL queries, risking leakage or modification of supplier and product data. The public exploit raises the risk.
Recommendation
Update the product or enforce validation of the txtProductName parameter; until fixed, restrict access to /admin/add_product.php.
Other vulnerabilities in Campcodes Supplier Management System
See all- CVE-2025-13260Medium
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_product.php. Manipulation of the cmbProductUnit argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed.
- CVE-2025-13259Medium
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_unit.php. Manipulation of the ID argument causes SQL injection. The attack may be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulation of the argument txtProductName leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS