CVE-2025-13270
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_course. Manipulation of the ID argument allows remote SQL injection. The exploit has been made public and could be used.
Risk Assessment
A remote attacker can exploit the vulnerability to gain unauthorized access to the database, potentially leading to data leakage or modification. The public exploit increases the risk of attack.
Recommendation
Immediately update the system and apply patches. Also use parameterized SQL queries and restrict access to sensitive files.
Other vulnerabilities in Campcodes School Fees Payment Management System
See all- CVE-2025-13273Medium
A SQL injection vulnerability has been discovered in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=delete_payment. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly released and may be used in attacks.
- CVE-2025-13269Medium
A SQL injection vulnerability has been found in Campcodes School Fees Payment Management System 1.0 in the file /ajax.php?action=save_payment. Manipulation of the ID argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been disclosed.
- CVE-2025-13057Medium
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
- CVE-2025-12612Medium
Campcodes School Fees Payment Management System 1.0 has a SQL Injection vulnerability in /ajax.php?action=delete_course via manipulation of the ID argument. The attack can be executed remotely and a public exploit is available.
Original NVD description (English source)
A vulnerability was found in Campcodes School Fees Payment Management System 1.0. This affects an unknown function of the file /ajax.php?action=save_course. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS