What is the CVSS score of CVE-2025-5676?

CVE-2025-5676 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5676?

A critical SQL injection vulnerability in the Campcodes Online Recruitment Management System allows unauthenticated attackers to remotely compromise the admin login functionality.

Is there a public PoC exploit available for CVE-2025-5676?

Yes, a public proof-of-concept exploit is available for CVE-2025-5676. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5676?

Within 24 hours: Isolate or take offline any instances of Campcodes ORMS 1.0 from production if possible; implement WAF rules to block malicious SQL injection patterns in the /admin/ajax.php login parameter; enable enhanced logging on authentication attempts. Within 7 days: Conduct forensic analysis of access logs to identify potential breaches; change all admin credentials; audit all user accounts and permissions for unauthorized modifications. Within 30 days: Migrate to a patched version when available or implement a complete replacement solution; perform full security assessment of recruitment systems.

PHP CVE-2025-5676

EUVD-2025-17022 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-05 cna@vuldb.com

PHP SQLi Online Recruitment Management System Campcodes

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-17022

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 10, 2025 - 19:31 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the authentication endpoint at /admin/ajax.php?action=login. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data exfiltration, or database manipulation. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

Technical ContextAI

This vulnerability represents a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in the administrative AJAX login handler. The affected endpoint fails to properly sanitize or parameterize user input in the Username parameter before incorporation into SQL queries. The vulnerability exists in a PHP-based web application (Campcodes Online Recruitment Management System) at the authentication layer, where the lack of input validation or prepared statements allows attackers to inject arbitrary SQL syntax. CWE-74, while broadly categorized as an output encoding issue, encompasses injection attacks where special characters bypass downstream SQL query construction. The root cause is insufficient input validation prior to SQL query execution in the authentication workflow.

RemediationAI

Immediate remediation steps: (1) Apply input validation and parameterized queries (prepared statements) to all user inputs in /admin/ajax.php, specifically the Username parameter—use parameterized SQL queries with bound variables rather than string concatenation; (2) Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint; (3) Upgrade to a patched version when released by Campcodes—monitor official vendor channels for security updates; (4) As interim mitigation, disable direct access to /admin/ajax.php?action=login if an alternative authentication method is available, or restrict IP access to administrative endpoints; (5) Conduct immediate database activity auditing for signs of prior exploitation. No official patch version has been publicly released as of this analysis—contact Campcodes directly for patch availability and timeline.