Is there a public PoC exploit available for CVE-2025-11409?

Yes, a public proof-of-concept exploit is available for CVE-2025-11409. Prioritise patching immediately. EPSS: 0.0%.

Campcodes Advanced Online Voting System CVE-2025-11409

Q: What is the CVSS score of CVE-2025-11409?

CVE-2025-11409 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-07 cna@vuldb.com

PHP SQLi Advanced Online Voting System Campcodes

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:32 vuln.today

DescriptionCVE.org

A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument voter results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

SQL injection in Campcodes Advanced Online Voting Management System 1.0 allows authenticated remote attackers to manipulate the voter parameter in /index.php, potentially leading to unauthorized data access or modification. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited confidentiality impact, but publicly available exploit code exists and exploitation probability is rated at 8th percentile by EPSS, suggesting this remains a lower-priority issue despite public POC availability.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP application handling voter-related parameters. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection') indicates that the application fails to sanitize or parameterize SQL queries constructed from user-supplied voter input. The /index.php endpoint accepts the voter parameter without sufficient SQL injection protections, allowing an authenticated user to inject arbitrary SQL commands. This is a classic SQL injection attack vector where attackers can craft malicious SQL syntax within the voter field to bypass query logic, extract data, or modify database contents.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate remediation requires either upgrading to a patched version (if available from Campcodes) or applying manual input validation controls. Implement parameterized queries or prepared statements for all database interactions in /index.php, specifically sanitizing the voter parameter using whitelist validation (e.g., accepting only numeric voter IDs or approved formats). As a compensating control, restrict access to /index.php via IP allowlist or Web Application Firewall (WAF) rules to authenticated internal networks only, or implement rate-limiting on voter parameter submissions to reduce automated exploitation. Contact Campcodes directly at www.campcodes.com for patch availability and security guidance. If the application is exposed to untrusted networks, consider disabling voter functionality temporarily until a fix is confirmed.