Campcodes Online Hotel Reservation System CVE-2025-8382

Exploitation requires valid admin-level authentication (PR:L) to access the /admin/edit_room.php endpoint. The vulnerability is triggered by direct manipulation of the room_id GET or POST parameter; the application must accept this parameter unsanitized in a SQL query. Default configurations of Campcodes 1.0 are vulnerable if admin accounts exist and are not adequately secured. No special network conditions, unusual application settings, or user interaction are required once admin access is obtained. The primary limiting factor is the authentication requirement-the attack cannot be executed against default installations by unauthenticated external attackers.

This vulnerability presents a LOW real-world priority despite public exploit availability. CVSS 4.0 vector indicates PR:L (requires authentication), limiting the attack surface to compromised or malicious admin accounts. EPSS score of 0.07% (20th percentile) strongly indicates minimal exploitation likelihood in the wild, contradicting the 'critical' severity label in the description-a classification inconsistency. The low confidentiality, integrity, and availability impact (L/L/L) combined with no scope change (SC:N) reflects that SQL injection here is constrained. However, the public exploit (E:P) means any attacker with admin access can trivially execute the attack. Real risk depends on admin credential hygiene: if admin accounts are well-protected, exploitation is unlikely; if admin credentials are commonly compromised or shared, this becomes medium-risk. The EPSS/CVSS mismatch suggests this is a valid vulnerability but not actively weaponized or broadly targeted.

An attacker with valid admin credentials (obtained via phishing, credential reuse, or insider threat) navigates to /admin/edit_room.php and injects a SQL payload such as room_id=1' UNION SELECT user_name, password FROM admin_users-- into the room_id parameter. The unsanitized input is concatenated into the SQL query, allowing the attacker to extract sensitive data (admin usernames, hashed passwords) or modify room records without triggering application-level authorization checks. Public exploit code on GitHub demonstrates this attack technique.