Payroll Management System EUVD-2025-20785

No authentication is required according to the CVSS 4.0 PR:N metric - the /ajax.php?action=save_position endpoint is reachable without valid session credentials. The application must be accessible over the network (typically HTTP/HTTPS on a web-facing port). Exploitation is limited to installations running exactly version 1.0 of Campcodes Payroll Management System. There is no required user interaction. The primary limiting factor is the product's niche deployment base; organizations not running this specific PHP application are unaffected. No special protocol, feature toggle, or non-default configuration is needed beyond a reachable web server.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) places the score at 5.5 (Medium), reflecting the trivially exploitable network path but capping impacts at Low across all three pillars. The PR:N metric indicates no authentication is required - notable for a payroll endpoint, though this may reflect AJAX endpoints that lack session enforcement. A public POC exists on GitHub, elevating practical risk despite the low EPSS of 0.05%. No CISA KEV listing and no evidence of active exploitation. The combination of low EPSS and niche product footprint suggests this remains largely opportunistic rather than targeted. The real-world risk to most organizations is low due to the obscurity of the product, but any organization running this specific version is directly exposed.

An unauthenticated attacker sends a crafted HTTP POST or GET request to /ajax.php?action=save_position with an ID parameter value containing a SQL injection payload such as 1 UNION SELECT user(),database(),3--. The backend PHP code interpolates this value directly into a SQL query, causing the database to return sensitive schema or credential data to the attacker. A public POC on GitHub demonstrates this technique, lowering the skill barrier to near zero.