CVE-2025-13273
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=delete_payment. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be used in attacks.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The publicly available exploit increases the risk of exploitation.
Recommendation
Immediately update the system or apply security patches. Also validate and parameterize SQL queries and restrict access to the /ajax.php file.
Other vulnerabilities in Campcodes School Fees Payment Management System
See all- CVE-2025-13270Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_course. Manipulation of the ID argument allows remote SQL injection. The exploit has been made public and could be used.
- CVE-2025-13269Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_payment. Manipulation of the ID argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been disclosed.
Original NVD description (English source)
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_payment. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS