CVE-2025-12612
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Campcodes School Fees Payment Management System 1.0 has a SQL Injection vulnerability in /ajax.php?action=delete_course via manipulation of the ID argument. The attack can be executed remotely and a public exploit is available.
Risk Assessment
A remote attacker could execute arbitrary SQL, risking data leakage or modification and compromise of the application.
Recommendation
Update or retire the vulnerable version as soon as possible; until patched, enforce parameter validation and WAF rules blocking SQL Injection attempts.
Other vulnerabilities in Campcodes School Fees Payment Management System
See all- CVE-2025-13273Medium
A SQL injection vulnerability has been discovered in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=delete_payment. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be used in attacks.
- CVE-2025-13270Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_course. Manipulation of the ID argument allows remote SQL injection. The exploit has been made public and could be used.
- CVE-2025-13269Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_payment. Manipulation of the ID argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been disclosed.
- CVE-2025-13057Medium
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_course. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS