EUVD-2025-17019Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=save_application. The manipulation of the argument position_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0 affecting the /admin/ajax.php?action=save_application endpoint. An unauthenticated remote attacker can manipulate the position_id parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
Technical ContextAI
The vulnerability stems from improper input validation in a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly leading to SQL injection). The affected endpoint /admin/ajax.php processes AJAX requests with an action parameter set to 'save_application'. The position_id parameter is passed directly into SQL queries without parameterized prepared statements or adequate input sanitization. The underlying technology is a PHP/MySQL-based recruitment management system. CPE identifier likely: cpe:2.3:a:campcodes:online_recruitment_management_system:1.0:*:*:*:*:*:*:*
RemediationAI
Immediate remediation steps: (1) Apply input validation and parameterized prepared statements to the position_id parameter in /admin/ajax.php to prevent SQL injection; (2) Implement whitelist validation for position_id (should be numeric/integer); (3) Use prepared statements with bound parameters for all database queries; (4) Add Web Application Firewall (WAF) rules to block SQL injection patterns targeting /admin/ajax.php; (5) Restrict access to /admin/ endpoints to authenticated users only; (6) Monitor database query logs for suspicious activity. Contact Campcodes directly for official patch availability—no public patch release is currently documented. Workaround: Disable or restrict network access to the vulnerable endpoint until patched. Long-term: Migrate to maintained, security-audited recruitment management software if Campcodes cannot provide timely patches.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today