CVE-2025-13269
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_payment. Manipulation of the ID argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been disclosed.
Risk Assessment
The vulnerability allows a remote attacker to execute unauthorized SQL queries, potentially leading to data confidentiality and integrity breaches. The public exploit increases the risk of exploitation.
Recommendation
Update the system as soon as possible and apply patches. Also use parameterized SQL queries and restrict access to the /ajax.php file.
Other vulnerabilities in Campcodes School Fees Payment Management System
See all- CVE-2025-13273Medium
A SQL injection vulnerability has been discovered in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=delete_payment. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be used in attacks.
- CVE-2025-13270Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_course. Manipulation of the ID argument allows remote SQL injection. The exploit has been made public and could be used.
Original NVD description (English source)
A vulnerability has been found in Campcodes School Fees Payment Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_payment. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS