Quick answers
- Is CVE-2026-122050 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-122050 being exploited in the wild.
- How severe is CVE-2026-122050?
- High severity, with a CVSS score of 7.3, published 5 November 2026.
- Which products and versions are affected?
- Campcodes Complete Sales and Inventory System with Credit Management 1.0.
- Is there a fix for CVE-2026-122050?
- No fixed version is recorded yet. Use prepared statements with parameterized queries for all database interactions, or at minimum cast and escape the branch parameter as an integer since it is a foreign key field. Restrict access to the login page at the network level if possible. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-122050 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-122050?
- Check whether you run Campcodes Complete Sales and Inventory System with Credit Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Use prepared statements with parameterized queries for all database interactions, or at minimum cast and escape the branch parameter as an integer since it is a foreign key field. Restrict access to the login page at the network level if possible.
Technical details
The vulnerability is a pre-authentication SQL injection in /ahira/login.php where the POST parameter branch is concatenated directly into a SQL query without escaping, while username and password are properly escaped. An attacker can submit any credentials paired with a malicious branch value (e.g., x' OR '1'='1) to bypass authentication and obtain an admin session. The application runs on PHP and MariaDB/MySQL databases, and exploitation requires network access to the login page with no authentication needed.
Affected products
- Campcodes Complete Sales and Inventory System with Credit Management 1.0
Timeline
- 2026-09-26: disclosed: Vulnerability discovered and proof of concept confirmed in lab environment