Which versions of PHP are affected by CVE-2025-7436?

A critical SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows remote attackers to compromise the database through the admin vacancy deletion function.

Is there a public PoC exploit available for CVE-2025-7436?

Yes, a public proof-of-concept exploit is available for CVE-2025-7436. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7436?

Within 24 hours: Disable or restrict access to /admin/ajax.php?action=delete_vacancy until patched; audit logs for exploitation attempts. Within 7 days: Implement WAF rules to block SQL injection payloads targeting this endpoint; consider isolating the recruitment system to restricted network access. Within 30 days: Evaluate replacement or upgrade of Campcodes system; conduct full database audit for unauthorized access; deploy continuous monitoring on recruitment infrastructure.

PHP CVE-2025-7436

Q: What is the CVSS score of CVE-2025-7436?

CVE-2025-7436 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21102 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-11 cna@vuldb.com

PHP SQLi Online Recruitment Management System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21102

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

PoC Detected

Jul 16, 2025 - 16:42 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_vacancy. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.

Technical ContextAI

The vulnerability exists in a PHP-based web application (Campcodes Online Recruitment Management System) handling administrative functions via AJAX endpoints. The root cause is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses improper input validation and parameterization in SQL query construction. The /admin/ajax.php file processes the 'action' parameter set to 'delete_vacancy' and directly incorporates user-supplied 'ID' values into SQL queries without adequate prepared statements or input sanitization. This classic second-order SQL injection pattern allows attackers to inject malicious SQL syntax through the ID parameter, bypassing intended query logic and executing attacker-controlled database operations.

RemediationAI

Immediate actions: (1) Apply parameterized queries/prepared statements to all database interactions in /admin/ajax.php—use parameterized DELETE statements with bound parameters for the ID field; (2) Implement strict input validation for the ID parameter (whitelist positive integers if IDs are numeric); (3) Add authentication/authorization checks to the admin AJAX endpoint to require valid admin session tokens; (4) Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter (e.g., signatures for single quotes, UNION keywords, comment sequences). Long-term: (1) Conduct a full code audit of all AJAX endpoints and database interaction points; (2) Implement object-relational mapping (ORM) frameworks that enforce parameterization; (3) Apply principle of least privilege to database users (admin panel user should not have DROP/ALTER permissions). Patch availability: Check Campcodes' official website, GitHub repository, or contact vendor directly for patched version; if no patch is available within 30 days, consider replacing the software or implementing compensating controls.