EUVD-2025-19029
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file Recruitment/admin/view_application.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6567 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, specifically in the Recruitment/admin/view_application.php file where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of recruitment records. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction.
Technical Context
The vulnerability exists in a PHP-based web application (Campcodes Online Recruitment Management System) that processes user-supplied input without proper parameterized query protection. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') indicates the root cause: the ID parameter in view_application.php is directly concatenated into SQL queries without adequate escaping or prepared statement usage. The affected component is an administrative interface (Recruitment/admin/view_application.php), suggesting the vulnerability may be in a protected administrative area, though the CVSS vector (PR:N) indicates no prior authentication is required, indicating either authentication bypass or an exposed administrative endpoint.
Affected Products
- product: Campcodes Online Recruitment Management System; version: 1.0; affected_component: Recruitment/admin/view_application.php; vulnerable_parameter: ID; vulnerability_type: SQL Injection (CWE-74); cpe_match: cpe:2.3:a:campcodes:online_recruitment_management_system:1.0:*:*:*:*:*:*:*
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today