CVE-2025-13269: Campcodes School Fees System SQLi Flaw

CVE-2025-13269 Overview

CVE-2025-13269 is a SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0. The flaw resides in the /ajax.php?action=save_payment endpoint, where the ID parameter is concatenated into a SQL query without proper sanitization. Authenticated remote attackers can manipulate this parameter to alter query logic, extract data, or modify records in the underlying database.

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). Public disclosure includes proof-of-concept details posted to a GitHub issue tracker and VulDB.

Critical Impact
Remote authenticated attackers can inject arbitrary SQL through the ID parameter of save_payment, exposing payment records and student financial data.

Affected Products

Campcodes School Fees Payment Management System 1.0
Deployments using cpe:2.3:a:campcodes:school_fees_payment_management_system:1.0
Web applications exposing /ajax.php?action=save_payment

Discovery Timeline

2025-11-17 - CVE-2025-13269 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13269

Vulnerability Analysis

The vulnerability exists in the AJAX handler /ajax.php?action=save_payment. The application accepts an ID parameter from the HTTP request and incorporates it directly into a SQL statement that processes payment save operations. Because the value is not parameterized or escaped, attackers can append SQL syntax to change query behavior.

Exploitation requires low-privilege authenticated access, which is typical for a fee payment portal that issues student or staff accounts. Once authenticated, the attacker submits crafted requests to the endpoint. Successful injection can return database contents, manipulate payment records, or escalate to broader database compromise depending on the database user privileges.

The issue affects confidentiality, integrity, and availability at a limited level, consistent with low-privileged scope inside the application's database context.

Root Cause

The root cause is direct string concatenation of user-controlled input into SQL queries. The save_payment action does not validate the type of the ID argument, nor does it use prepared statements or parameterized queries. This is a classic [CWE-89] pattern common in PHP applications that build queries with mysqli_query or equivalent functions using untrusted request data.

Attack Vector

The attack is delivered over the network through an HTTP POST or GET request to /ajax.php?action=save_payment with a tampered ID value. The attacker authenticates to the application, then submits payloads such as boolean-based, union-based, or time-based SQL injection strings in the ID field. No user interaction is required beyond the attacker's own session.

A proof-of-concept and additional technical context are available in the GitHub CVE Issue Discussion and VulDB #332604.

Detection Methods for CVE-2025-13269

Indicators of Compromise

HTTP requests to /ajax.php?action=save_payment containing SQL metacharacters such as ', ", --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
Web server access logs showing unusually long ID values or repeated requests with incremental payloads from the same authenticated session.
Database error messages in application logs referencing syntax errors near the ID field during save_payment execution.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the ID parameter on save_payment requests for SQL injection signatures.
Enable database query logging and alert on queries originating from the save_payment handler containing unbounded UNION SELECT or time-delay functions.
Correlate authenticated session identifiers with anomalous request volumes against the /ajax.php endpoint.

Monitoring Recommendations

Monitor authentication logs for newly created low-privilege accounts followed by activity against save_payment.
Track outbound database read volumes from the application service account for spikes that suggest mass extraction.
Review application error logs for repeated SQLSTATE exceptions tied to the payment workflow.

How to Mitigate CVE-2025-13269

Immediate Actions Required

Restrict network access to the Campcodes School Fees Payment Management System to trusted users until a fix is applied.
Disable or proxy the /ajax.php?action=save_payment endpoint behind a WAF that blocks SQL injection payloads in the ID parameter.
Rotate database credentials used by the application and review the database account's privileges to enforce least privilege.

Patch Information

No vendor patch has been published in the references at the time of NVD entry. Administrators should monitor the CampCodes Security Blog and the GitHub CVE Issue Discussion for updated guidance. Until an official fix is available, code-level remediation must be applied by replacing concatenated SQL with parameterized queries in the save_payment handler.

Workarounds

Modify the application source to use prepared statements (for example, mysqli_prepare with bound parameters or PDO with bindParam) for the ID argument.
Add server-side input validation that rejects non-integer values for the ID parameter before reaching SQL execution.
Apply virtual patching via WAF signatures targeting SQL metacharacters in action=save_payment requests.

bash

# Example ModSecurity rule to block SQLi attempts on the vulnerable endpoint
SecRule REQUEST_URI "@contains /ajax.php" \
    "chain,phase:2,deny,status:403,id:1013269,msg:'CVE-2025-13269 SQLi attempt on save_payment'"
    SecRule ARGS:action "@streq save_payment" \
        "chain"
        SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|or\s+1=1|--|;)" "t:none,t:urlDecodeUni"