EUVD-2025-17022Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the authentication endpoint at /admin/ajax.php?action=login. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data exfiltration, or database manipulation. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Technical ContextAI
This vulnerability represents a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in the administrative AJAX login handler. The affected endpoint fails to properly sanitize or parameterize user input in the Username parameter before incorporation into SQL queries. The vulnerability exists in a PHP-based web application (Campcodes Online Recruitment Management System) at the authentication layer, where the lack of input validation or prepared statements allows attackers to inject arbitrary SQL syntax. CWE-74, while broadly categorized as an output encoding issue, encompasses injection attacks where special characters bypass downstream SQL query construction. The root cause is insufficient input validation prior to SQL query execution in the authentication workflow.
RemediationAI
Immediate remediation steps: (1) Apply input validation and parameterized queries (prepared statements) to all user inputs in /admin/ajax.php, specifically the Username parameter—use parameterized SQL queries with bound variables rather than string concatenation; (2) Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint; (3) Upgrade to a patched version when released by Campcodes—monitor official vendor channels for security updates; (4) As interim mitigation, disable direct access to /admin/ajax.php?action=login if an alternative authentication method is available, or restrict IP access to administrative endpoints; (5) Conduct immediate database activity auditing for signs of prior exploitation. No official patch version has been publicly released as of this analysis—contact Campcodes directly for patch availability and timeline.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today