EUVD-2025-20230Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRecon: Identify vulnerable /ajax.php endpoint
-
DeliveryDelivery: Send crafted HTTP GET with SQL payload
-
ExploitExploit: SQL injection bypasses input validation
-
ExecutionExecute: Execute arbitrary SQL commands on database
-
ImpactImpact: Extract or delete payroll records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Campcodes Payroll Management System 1.0. The attack requires no authentication, no user interaction, and targets a publicly accessible endpoint. Limiting factors: the product must be network-reachable and the delete_payroll action must be exposed; however, these are typical deployment defaults. |
| Impact | CVSS 4.0 base score 5.5 (Medium) reflects a low-complexity, unauthenticated remote attack with limited but real impact (VC:L/VI:L/VA:L). EPSS at 0.06% and absence from CISA KEV indicate low active exploitation risk, but publicly available exploit code lowers the barrier for opportunistic attackers. The risk is moderate: easy to exploit but currently not widely targeted. SSVC considerations: exploitation status 'no evidence of active exploitation', automatable, technical impact 'partial'. The contrast between easy exploitation and low EPSS suggests that effective compensating controls or limited deployment reduce overall risk. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP GET request to /ajax.php?action=delete_payroll with a malicious SQL payload in the ID parameter. Because no authentication or user interaction is required, the injected SQL command executes, allowing the attacker to extract sensitive payroll data or delete entire records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
RemediationAI
No vendor-released patch has been identified. As compensating controls, restrict network access to the payroll management system via firewall rules, disable the delete_payroll endpoint if not operationally required, implement strict input validation and parameterized queries for the ID parameter, and deploy a Web Application Firewall (WAF) configured to block SQL injection patterns. Note that disabling endpoint functionality may break payroll deletion workflows, and WAFs can introduce false positives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based payroll management web application. The endpoint /ajax.php?action=delete_payroll processes user-supplied input from the 'ID' parameter without proper sanitization, allowing direct execution of SQL statements against the underlying database. This class of flaw typically leads to unauthorized data access, modification, or deletion.
Know when Payroll Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Low impact consistent with delete endpoint; AV:N/AC:L/PR:N/UI:N unauthenticated remote attack.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_payroll. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Payroll Management System
View allSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vul
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?acti
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (C
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rat
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands throug
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend d
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulner
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department al
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /a
Exploit-DB