EUVD-2025-20788Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess network-exposed web application
-
DeliverySend malicious HTTP request to /ajax.php?action=delete_position
-
ExploitInject SQL payload in the ID parameter
-
ExecutionExecute injected SQL queries
-
ImpactManipulate or exfiltrate payroll data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Campcodes Payroll Management System 1.0. The vulnerable endpoint must be accessible over the network, and the application must have an active database connection. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates remote, unauthenticated exploitation with low technical complexity, but only partial impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low real-world exploitation likelihood, and it is not listed in CISA KEV. Although a public proof-of-concept exists, the low-impact nature and the product's limited deployment footprint mean the risk is moderate at best. The discrepancy between the 'critical' classification by the reporter and the low CVSS base metrics should be noted-this is likely a high-CVSS-by-vendor-label but low-real-risk issue. |
| Exploit ScenarioDerived | A remote attacker sends an HTTP request to /ajax.php?action=delete_position with a crafted ID value containing SQL payloads. The application passes the unsanitized input to the database, allowing the attacker to execute arbitrary SQL statements. This can lead to unauthorized reading, modification, or deletion of payroll records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch has been identified. Immediate mitigation should include restricting access to the vulnerable endpoint /ajax.php?action=delete_position via web server configuration (e.g., .htaccess deny rules) or a web application firewall rule that blocks SQL injection patterns in the ID parameter. Limit network exposure to trusted IP ranges. As the product appears unmaintained, consider migrating to a supported payroll solution. Monitoring for unusual database queries is advisable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in a PHP-based web application that processes an ID argument in the /ajax.php?action=delete_position endpoint without proper sanitization, leading to an SQL injection (CWE-74: Injection). The affected product, identified by CPE cpe:2.3:a:campcodes:payroll_management_system:1.0, is a legacy payroll application that constructs database queries using user-supplied input from HTTP requests, allowing an attacker to alter query logic.
Know when Payroll Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated SQL injection with low impact on all three CIA dimensions as per the disclosed vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability face moderate risk from CVE-2025-7218, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Payroll Management System
View allSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Rated critical severity (CVSS 9.8), this vul
Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Rated
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0.php?acti
A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Rated medium severity (C
Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter. Rat
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands throug
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQ
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend d
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulner
SQL injection in code-projects Payroll Management System 1.0 via the ID parameter in /ajax.php?action=save_department al
Exploit-DB