CVE-2025-9505 - Campcodes Online Loan Management System ajax.php sql injection

Back Back to CVE browser

MEDIUM

Campcodes Online Loan Management System ajax.php sql injection

Published Aug 27, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.48%

Description

A flaw has been found in Campcodes Online Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_loan_type. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Affected products

Vendor Campcodes Product Online Loan Management System Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Campcodes

Online Loan Management System

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25869
Advisory
https://github.com/Sxxxw/cve/issues/1
exploitissue-trackingThird Party Advisory
https://vuldb.com/?ctiid.321488
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.321488
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638139
third-party-advisoryThird Party AdvisoryVDB Entry
https://www.campcodes.com/
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25869		Advisory
https://github.com/Sxxxw/cve/issues/1		exploitissue-trackingThird Party Advisory
https://vuldb.com/?ctiid.321488		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.321488		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.638139		third-party-advisoryThird Party AdvisoryVDB Entry
https://www.campcodes.com/		product