Is there a public PoC exploit available for CVE-2025-8336?

Yes, a public proof-of-concept exploit is available for CVE-2025-8336. Prioritise patching immediately. EPSS: 0.1%.

Online Recruitment Management System CVE-2025-8336

Q: What is the CVSS score of CVE-2025-8336?

CVE-2025-8336 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-30 cna@vuldb.com

PHP SQLi Online Recruitment Management System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint (AV:N/PR:N/UI:N); SQL injection yields partial read, write, and availability disruption (C:L/I:L/A:L); scope unchanged as impact is confined to the application database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:42 vuln.today

CVE Published

Jul 30, 2025 - 23:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_user. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

The affected product is a PHP-based web recruitment application confirmed at version 1.0 per CPE cpe:2.3:a:campcodes:online_recruitment_management_system:1.0. The root cause is classified under CWE-74 (Injection), the parent class for SQL injection (CWE-89), indicating the application builds database queries through unsanitized string concatenation rather than parameterized queries or prepared statements - a common anti-pattern in legacy PHP codebases. The vulnerable code path is the admin AJAX handler (/admin/ajax.php), a server-side PHP script that processes the save_user action and passes the id argument directly into a SQL statement without input validation or escaping. The database backend is not specified in available intelligence but is typical MySQL for PHP applications of this type.

RemediationAI

No vendor-released patch has been identified at time of analysis. The immediate priority for administrators is to restrict network access to the /admin/ajax.php endpoint at the web server or firewall layer - this is an administrative endpoint with no legitimate public-facing requirement, and IP allowlisting to trusted administrator networks will eliminate remote exploitation risk without functional impact. Deploying a Web Application Firewall with SQL injection detection rules (e.g., ModSecurity with OWASP CRS) provides a compensating control for environments where endpoint restriction is not immediately feasible, though WAF bypass is possible with advanced payloads. For durable remediation, the application's PHP code must be refactored to use PDO or MySQLi prepared statements with bound parameters for all database interactions involving user-supplied input. Technical details and the POC are available at https://github.com/CVE-Hunter-Leo/CVE/issues/2 and https://vuldb.com/?id.318286.