Cyber Resilience

CVE-2025-7218

MediumPublic PoC

Published: 09 July 2025

Published
09 July 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v4 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0021 43.7th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7218 is a medium-severity Injection (CWE-74) vulnerability in Campcodes Payroll Management System. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-7218 is a critical SQL injection vulnerability (CWE-74, CWE-89) in Campcodes Payroll Management System version 1.0. The flaw affects the processing of the file /ajax.php?action=delete_position, where manipulation of the ID argument enables SQL injection.

The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), allowing remote attackers with no privileges or user interaction to exploit it over the network with low attack complexity. Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability via SQL injection.

Advisories are available through VulDB entries (ctiid.315167, id.315167, submit.608252) and a related GitHub issue at falling-snow1/vuldb/issues/2, with the vendor site at campcodes.com. The exploit has been publicly disclosed and may be used by attackers.

EU & UK References

Vulnerability details

A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely.…

more

The exploit has been disclosed to the public and may be used.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct remote SQL injection in a publicly accessible web application endpoint (/ajax.php) enables unauthenticated exploitation of a public-facing app.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-7220Same product: Campcodes Payroll Management System
CVE-2025-7219Same product: Campcodes Payroll Management System
CVE-2025-7217Same product: Campcodes Payroll Management System
CVE-2026-0597Same vendor: Campcodes
CVE-2025-0210Same vendor: Campcodes
CVE-2025-9744Same vendor: Campcodes
CVE-2025-7183Same vendor: Campcodes
CVE-2025-0212Same vendor: Campcodes
CVE-2024-57162Same vendor: Campcodes
CVE-2026-3150Shared CWE-74, CWE-89

Affected Assets

campcodes
payroll management system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of the ID parameter in /ajax.php?action=delete_position to block SQL injection payloads before they reach the database.

SI-2 Flaw Remediation partial match
prevent

Mandates timely remediation of the publicly disclosed SQL injection flaw in the Campcodes Payroll Management System.

SI-4 System Monitoring partial match
detect

Enables monitoring of application inputs and database queries to identify SQL injection attempts against the delete_position action.

References