What is the CVSS score of CVE-2025-5677?

CVE-2025-5677 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5677?

A publicly disclosed SQL injection vulnerability in the Campcodes Online Recruitment Management System allows remote attackers to compromise the recruitment database and potentially access or modify…

Is there a public PoC exploit available for CVE-2025-5677?

Yes, a public proof-of-concept exploit is available for CVE-2025-5677. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5677?

Within 24 hours: Identify all systems running Campcodes 1.0 and restrict network access to /admin/ajax.php to authorized IP ranges only. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious SQL injection patterns targeting the position_id parameter and disable the vulnerable application feature if operationally feasible. Within 30 days: Contact Campcodes for patch availability or plan migration to a patched/alternative recruitment system; conduct database audit for evidence of exploitation.

PHP CVE-2025-5677

EUVD-2025-17019 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-05 cna@vuldb.com

PHP SQLi Online Recruitment Management System Campcodes

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-17019

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

PoC Detected

Jun 10, 2025 - 19:31 vuln.today

Public exploit code

CVE Published

Jun 05, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=save_application. The manipulation of the argument position_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0 affecting the /admin/ajax.php?action=save_application endpoint. An unauthenticated remote attacker can manipulate the position_id parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.

Technical ContextAI

The vulnerability stems from improper input validation in a PHP-based web application (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly leading to SQL injection). The affected endpoint /admin/ajax.php processes AJAX requests with an action parameter set to 'save_application'. The position_id parameter is passed directly into SQL queries without parameterized prepared statements or adequate input sanitization. The underlying technology is a PHP/MySQL-based recruitment management system. CPE identifier likely: cpe:2.3:a:campcodes:online_recruitment_management_system:1.0:*:*:*:*:*:*:*

RemediationAI

Immediate remediation steps: (1) Apply input validation and parameterized prepared statements to the position_id parameter in /admin/ajax.php to prevent SQL injection; (2) Implement whitelist validation for position_id (should be numeric/integer); (3) Use prepared statements with bound parameters for all database queries; (4) Add Web Application Firewall (WAF) rules to block SQL injection patterns targeting /admin/ajax.php; (5) Restrict access to /admin/ endpoints to authenticated users only; (6) Monitor database query logs for suspicious activity. Contact Campcodes directly for official patch availability—no public patch release is currently documented. Workaround: Disable or restrict network access to the vulnerable endpoint until patched. Long-term: Migrate to maintained, security-audited recruitment management software if Campcodes cannot provide timely patches.