EUVD-2025-20230Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low impact consistent with delete endpoint; AV:N/AC:L/PR:N/UI:N unauthenticated remote attack.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_payroll. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based payroll management web application. The endpoint /ajax.php?action=delete_payroll processes user-supplied input from the 'ID' parameter without proper sanitization, allowing direct execution of SQL statements against the underlying database. This class of flaw typically leads to unauthorized data access, modification, or deletion.
RemediationAI
No vendor-released patch has been identified. As compensating controls, restrict network access to the payroll management system via firewall rules, disable the delete_payroll endpoint if not operationally required, implement strict input validation and parameterized queries for the ID parameter, and deploy a Web Application Firewall (WAF) configured to block SQL injection patterns. Note that disabling endpoint functionality may break payroll deletion workflows, and WAFs can introduce false positives.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today