CVE-2025-4929 is a high severity SQL injection (CVSS 7.3) in Campcodes Online Shopping Portal 1.0. The file /my-account.php builds a database query from user input (Name) without neutralising it. The record lists no fixed version, so restrict access and correct the query in code.
What's affected
The record lists Campcodes Online Shopping Portal version 1.0. The vulnerable file is /my-account.php, and the input is Name. An account page that saves profile fields is a place where several user supplied values reach the database.
The CVE record does not give a patched version, and I found no vendor patch in the pages I could read. Check the vendor site and the public report listed under Sources before you assume a fix exists. If you run a fork or a copy that someone adapted for internal use, assume it carries the same flaw until you have read the code.
The same product has other entries in this batch of records: CVE-2025-4930 (/my-cart.php). Treat the whole application as suspect rather than patching one page and moving on.
How to check if you're exposed
Start with inventory. This kind of software is often downloaded as a source code sample, adapted, and left running on a shared host, so nobody remembers it is there. Search your web roots for the file named in the record. Adjust the path to your server layout.
find /var/www -name "my-account.php" -type f 2>/dev/null
Then read how the file builds its query. A string joined together with the request value is the warning sign. A prepared statement with bound parameters is the safe form.
grep -n "Name" /var/www/html/my-account.php
grep -nE "mysqli_query|->query\(" /var/www/html/my-account.php
Finally look at your access logs for requests to /my-account.php. Unusually long values, or values full of quote characters, in the Name input deserve a closer look. A web application scan can confirm from the outside whether the page is reachable and what it runs.
What to do now
- Find every copy of Campcodes Online Shopping Portal in your environment, including test and demo installs.
- Take it off the public internet, or put it behind a VPN or an IP allow list, until the code is fixed.
- Replace string built queries in /my-account.php with prepared statements and bound parameters, and review the other pages of the application for the same pattern.
- Run the application's database account with the fewest rights it needs, and never with administrator rights over the whole server.
- Remove real personal or business data from any copy that does not need it, and rotate passwords stored in the database if you see signs of abuse.
- Watch the vendor site and the public issue for a release, and plan to move to a maintained application if none appears.
Why it matters
The weakness is SQL injection, filed as CWE-89 and the broader injection class CWE-74. SQL injection has been understood for a very long time. It keeps appearing in small PHP applications because queries are often built by joining strings, and a framework that would force parameter binding is not in the way.
The record gives the score as 7.3 with a network attack vector and low complexity. The vector rates impact as low for confidentiality, low for integrity and low for availability. A database sits behind the page, and the real outcome depends on what that database holds and what rights the application account has. This CVE is not on the CISA Known Exploited Vulnerabilities list, and neither the record nor the pages I read report exploitation in the wild. The record does say the exploit has been disclosed to the public, which is enough reason to act before someone tries it against you.
Quick check
Does the CVSS vector say I need an account?
The vector lists no privileges required. The record also says the attack can start remotely. Read it as exposed to anyone who can reach the application, and confirm against your own copy of the code.
Is there a patch I can install?
The CVE record does not name a fixed version, and I could not confirm a vendor release. Check the vendor site and the public issue linked below. If nothing is available, fix the query yourself with prepared statements and keep the application off the open internet.
Sources
Last reviewed: 18 October 2026.
