CVE-2025-9678 is a high severity (CVSS 7.3) SQL injection in Campcodes Online Loan Management System 1.0. The ID argument of /ajax.php?action=delete_borrower reaches a database query unsafely, and the record says a public exploit exists. No fixed release is listed, so limit access and correct the query in code.
What's affected
The record lists Campcodes Online Loan Management System version 1.0. The vulnerable code is /ajax.php?action=delete_borrower, and the affected input is ID. The description says the attack can be carried out remotely and that the exploit has been disclosed publicly.
No fixed version appears in the record, and none of the pages I could reach named one. If the project later publishes a patched release, the maintainer's page is the place to confirm it. Until then, treat every deployed copy of version 1.0 as exposed.
The weakness is classed as CWE-89 (SQL injection) under the broader CWE-74 (injection) family. The record scores it 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, no privileges and no user interaction, with low impact on confidentiality, integrity and availability.
How to check if you're exposed
Start with inventory. Work out whether you run Online Loan Management System at all, and which version. Then look for the file the record names.
find /var/www -type f -name "ajax.php"
Adjust the path to wherever your web root lives. A hit on a copy of version 1.0 means the code is present. Next, check reachability: is the application open to the internet, or only to an internal network?
For signs of abuse, read the web server access log for requests to the affected path. Look for odd characters, SQL keywords and unusually long values:
grep -E "ajax\.php" /var/log/apache2/access.log | tail -n 100
Access logs show the URL and query string but usually not POST bodies, so also read the PHP and database error logs for query syntax errors and sudden bursts of failures. The free dependency scan at gold.safeguard.sh/scan covers libraries you declare, so it will not see a flaw inside application code you downloaded or wrote yourself. For that, a code scan is the right tool.
What to do now
- Find every deployment of Online Loan Management System 1.0, including test and demo copies that were never meant to be public.
- Take the application off the open internet, or put it behind a VPN, an IP allowlist or web server authentication until the code is fixed.
- Replace string built queries in
ajax.phpwith prepared statements and bound parameters (mysqli or PDO in PHP), and validate the type ofIDbefore it gets near the database. - Run the application's database account with the least privilege it needs: no administrative rights and no access to other schemas.
- Review access and error logs for the affected path, and rotate database and application credentials if you see signs of abuse.
- Check the project page now and then for a patched release, and retire the application if it is unmaintained.
Why it matters
SQL injection happens when input from a request is placed into a database query as if it were part of the query itself. The database cannot tell the difference between the developer's statement and the visitor's text, so a crafted value can change what the statement does. The fix is old and well understood: pass values separately from the statement.
A loan system holds borrower identities, loan terms and repayment history, so a query flaw in an admin action is worth taking seriously even at a modest score. The record does not say which data an attacker could reach in this deployment, only that confidentiality, integrity and availability are each rated low.
The CVE is not in the CISA Known Exploited Vulnerabilities catalog according to the record. The record does state that a public exploit exists, which is a reason to move quickly on any internet facing copy.
Quick check
Is there a patch for CVE-2025-9678?
The record names no fixed version, and I could not confirm one from the pages I reached. Check the project page, and meanwhile restrict access and fix the query in your own copy.
Do I need to be logged in to exploit CVE-2025-9678?
The vector in the record has no privileges required and no user interaction, so it is treated as reachable by a remote visitor. Confirm against your own deployment, since a login wall you added may change the picture.
Sources
- Public report cited by the record: https://github.com/1276486/CVE/issues/3
- Safeguard Gold entry: CVE-2025-9678
- CVE record fields (description, CVSS score and vector, CWE, product, published date) as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
