EUVD-2025-19615Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /changepassemp.php with malicious ID parameter
-
ExploitSQL injection in password change query
-
ExecutionExecute arbitrary SQL statements
-
ImpactExtract or modify user data in the database.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Campcodes Employee Management System 1.0, specifically targeting the /changepassemp.php endpoint. |
| Impact | The CVSS 4.0 base score of 5.5 (medium) combines a network attack vector, low complexity, and no privileges or user interaction with low impact on confidentiality, integrity, and availability. The EPSS 0.06% (19th percentile) suggests exploitation is unlikely, and the vulnerability is not listed in CISA KEV. Despite publicly available proof-of-concept code, the low EPSS and the niche nature of the product (see prevalence) reduce real-world priority. The SSVC decision would likely be ‘defer’ due to low mission prevalence and moderate impact, though the existence of a public exploit warrants awareness. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to the vulnerable /changepassemp.php endpoint, injecting SQL payloads through the ID parameter. This can exfiltrate user credentials from the database or manipulate account records, potentially leading to administrative takeover. Proof-of-concept code is publicly available on GitHub (https://github.com/ez-lbz/poc/issues/34). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter of the /changepassemp.php password change page. This unauthenticated, remotely exploitable flaw can lead to unauthorized data access or modification. Public exploit code is available, but the EPSS score of 0.06% indicates low exploitation probability, and no active exploitation has been confirmed.
Earlier versions of this analysis (1)
RemediationAI
No vendor patch has been released. As a workaround, restrict network access to /changepassemp.php, implement a web application firewall rule to block SQL injection attempts, or disable the password change feature if feasible. For development teams with source access, modify the script to use parameterized queries for the ID parameter. Regularly monitor VulDB or the vendor’s site for an official fix, but since Campcodes scripts are often sold as-is, a patch may not be forthcoming.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the /changepassemp.php script, where the ID argument is directly concatenated into an SQL query without proper sanitization, resulting in an injection flaw. Classified under CWE-74, improper neutralization of special elements, the root cause is typical of PHP applications that fail to use parameterized queries. The affected product is specifically Campcodes Employee Management System 1.0 (cpe:2.3:a:campcodes:employee_management_system:1.0), a web-based HR application likely intended for small businesses.
Know when Employee Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network vector, low complexity, no privileges; SQL injection typically allows limited data theft and tampering, with minor availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Campcodes Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /changepassemp.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability face moderate risk from CVE-2025-6956, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Employee Management System
View allSQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL comm
SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the ad
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the mailud parameter at /apro
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aproces
An issue in Employee Managment System v1.0 allows attackers to bypass authentication via injecting a crafted payload int
A vulnerability was found in SourceCodester Employee Management System 1.0. Rated critical severity (CVSS 9.8), this vul
A vulnerability was found in SourceCodester Employee Management System. Rated critical severity (CVSS 9.8), this vulnera
A vulnerability was found in SourceCodester Employee Management System. Rated critical severity (CVSS 9.8), this vulnera
A vulnerability has been found in SourceCodester Employee Management System and classified as critical. Rated critical s
A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. Rated high severit
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /delete.p
Exploit-DB