CVE-2025-13270
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_course. Manipulation of the ID argument allows remote SQL injection. The exploit has been made public and could be used.
Risk Assessment
A remote attacker can exploit the vulnerability to gain unauthorized access to the database, potentially leading to data leakage or modification. The public exploit increases the risk of attack.
Recommendation
Immediately update the system and apply patches. Also use parameterized SQL queries and restrict access to sensitive files.
Other vulnerabilities in Campcodes School Fees Payment Management System
See all- CVE-2025-13273Medium
A SQL injection vulnerability has been discovered in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=delete_payment. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be used in attacks.
- CVE-2025-13269Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_payment. Manipulation of the ID argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been disclosed.
Original NVD description (English source)
A vulnerability was found in Campcodes School Fees Payment Management System 1.0. This affects an unknown function of the file /ajax.php?action=save_course. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS