CVE-2025-9502 MEDIUM

CVE-2025-9502: Campcodes Online Loan Management System ajax.php sql injection

Vendor Campcodes

Product Online Loan Management System

Weakness CWE-89 · SQLi

Published August 27, 2025

Last update August 27, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=save_payment. Executing manipulation of the argument loan_id can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Key dates

02Disclosure timeline

August 27, 2025 CVE published

August 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-9502

Related vulnerabilities

04Related CVE

CVE-2024-4906 Campcodes Complete Web-Based School Management System show_student1.php sql injection CVE-2025-4813 PHPGurukul Human Metapneumovirus Testing Management System edit-phlebotomist.php sql injection CVE-2025-3998 CodeAstro Membership Management System renew.php sql injection CVE-2024-4801 Kashipara College Management System submit_new_faculty.php sql injection CVE-2026-24993 WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability