CVE-2025-7131: High SQL Injection in Campcodes Payroll

CVE-2025-7131 is a high severity (7.3) SQL injection in Campcodes Payroll Management System 1.0. The employee_id argument handled by /ajax.php?action=save_employee_attendance reaches a database query unsafely. The record lists no fixed version, so limit access, repair the query with a prepared statement, or retire the application.

What's affected

• Product: Campcodes Payroll Management System, version 1.0 (the only version named in the record).
• Component: /ajax.php?action=save_employee_attendance, which is an AJAX action that saves employee attendance.
• Parameter: employee_id.
• Fixed version: none is listed in the record or in the sources we could reach. Check the vendor site for a newer release before assuming one exists.

The NVD record scores this 7.3 (High, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The description, which comes from VulDB, calls the issue "critical". Both statements are in the record, so treat the CVSS score as the formal rating and the word "critical" as VulDB's own wording.

The record sets no KEV flag, and none of the pages we fetched say the issue is exploited against real systems. It does say a public disclosure exists, and that is enough reason to treat the flaw as known to attackers.

How to check if you're exposed

This is a self-hosted PHP application, not a package from a registry, so there is no package manager command that answers the question. Work through these checks instead.

1. Find out whether you run it. Search your web roots and deployment inventory for the product name and for the file /ajax.php.
2. Confirm the version. The record only names 1.0, so if you cannot tell which release you have, assume you are affected.
3. Look at how the file builds its query. In the source, search for places where employee_id or the matching request variable is joined into a SQL string. A grep such as the one below shows candidates.

grep -rn "mysqli_query\|mysql_query\|->query(" /var/www/html | grep -i "\$_\(GET\|POST\|REQUEST\|COOKIE\)"

4. Review web server and database logs for unusual values sent to /ajax.php, such as stray quotes, SQL keywords or very long inputs. Repeated errors from the database layer are a warning sign.
5. Check whether the application is reachable from the internet. The record describes a remote attack with no privileges and no user interaction, so internet exposure is what raises the urgency.

What to do now

1. Take the application off the public internet, or place it behind a VPN or an IP allow list, until it is fixed.
2. Replace the vulnerable query with a prepared statement. In PHP with mysqli the pattern looks like this.

$stmt = $mysqli->prepare("SELECT * FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();

3. Run the application's database account with the fewest rights it needs. It should not own the schema or have file or administrative privileges.
4. Add a web application firewall rule or request validation in front of /ajax.php as a stopgap, and do not count it as a fix.
5. Check the vendor site for a patched release. If none exists, plan to replace the application and review the rest of its pages for the same pattern.
6. Rotate any credentials stored in the database if logs suggest someone probed the endpoint.

Why it matters

The weakness here is the oldest one in web development. A request value is concatenated into a SQL statement instead of being passed as a bound parameter, so the database may treat part of the value as SQL.

The class is tracked as CWE-89 (SQL injection) under the broader CWE-74 (injection). The flaw sits in an AJAX action that saves employee attendance, so the data behind it is what is at risk: records in the Payroll Management System database, and possibly stored credentials. The vector in the record rates confidentiality, integrity and availability each as low impact, which is why the score stops at 7.3. Real impact depends on what the database account can reach.

The pattern repeats across small PHP applications. When one page builds queries by string concatenation, others usually do too, and public disclosures tend to arrive in groups. Fixing one parameter and leaving the rest leaves the same exposure in place.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• campcodes Payroll Management System V1.0 /Payroll_Management_System/ajax.php?action=save_employee_attendance SQL injection · Issue #19 · wyl091256/CVE
• Gold page for CVE-2025-7131
• NVD record for CVE-2025-7131, published 2025-07-07, CNA VulDB.
• Gold page for CWE-89

The researcher issue linked from the record was read and matches the record.

Last reviewed: 18 October 2026.