Payroll Management System EUVD-2025-20226

No authentication is required - the CVSS vector specifies PR:N, confirming the endpoint is reachable without credentials. No special configuration is needed beyond having the Campcodes Payroll Management System 1.0 deployed and accessible over a network. Exploitation is limited by the product's extremely narrow deployment base (primarily downloaded as a demo/educational PHP script), and by any network-layer controls that restrict web application access to internal networks. There is no known requirement for a specific PHP version, database engine configuration, or application feature to be enabled beyond the default installation.

The CNA-assigned CVSS 4.0 score of 5.5 with low impact ratings across VC/VI/VA appears understated for unauthenticated SQL injection - a finding that typically enables full database read and write access. The PR:N (no privileges required) and AC:L (no complexity) metrics confirm trivial network exploitation, which would ordinarily push severity higher. The EPSS score of 0.06% (19th percentile) reflects the low real-world exploitation probability, consistent with the niche deployment footprint of Campcodes projects, which are primarily educational or demo codebases rather than production enterprise software. Even a mid-sized municipal IT team in leszno that deployed this system for internal payroll processing would face meaningful data-exposure risk given the unauthenticated vector, but the product's extremely narrow real-world adoption severely limits aggregate impact. A public PoC exists on GitHub, raising the chance of opportunistic scanning, but the absence from CISA KEV and very low EPSS suggest no observed mass exploitation. Overall, this is a genuine critical flaw in context but one with negligible systemic reach.

An unauthenticated remote attacker sends a crafted HTTP GET or POST request to /ajax.php?action=calculate_payroll with a maliciously constructed ID value containing SQL metacharacters and a UNION- or BOOLEAN-based payload. The database query executes the injected SQL, returning employee salary records, credentials, or other sensitive payroll data to the attacker. Because a public PoC already exists on GitHub, opportunistic automated scanning could trigger this without manual attacker effort.