CVE-2025-13274: Campcodes School Fees System SQLi Flaw

CVE-2025-13274 Overview

CVE-2025-13274 is a SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0. The flaw resides in the /ajax.php?action=delete_fees endpoint, where the ID parameter is passed to a database query without proper sanitization. Remote attackers with low-level authentication can manipulate the ID argument to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The vulnerability is tracked under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Authenticated remote attackers can inject SQL through the delete_fees action, exposing fee records, student data, and potentially the entire backend database.

Affected Products

Campcodes School Fees Payment Management System 1.0
cpe:2.3:a:campcodes:school_fees_payment_management_system:1.0
Deployments exposing /ajax.php?action=delete_fees to untrusted networks

Discovery Timeline

2025-11-17 - CVE-2025-13274 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13274

Vulnerability Analysis

The vulnerability stems from unsafe handling of the ID query parameter inside the delete_fees action handler in ajax.php. The application concatenates the user-supplied ID value directly into a SQL DELETE or related statement without parameterization or input validation. An authenticated remote attacker can submit a crafted request that breaks out of the intended query context and executes attacker-controlled SQL.

Because the endpoint is reachable over HTTP and only requires low-privilege authentication, automated tooling such as sqlmap can enumerate the injection point with minimal effort. The Exploit Prediction Scoring System (EPSS) places this CVE in the 17th percentile, reflecting limited but non-zero in-the-wild interest. Public disclosure of the exploit raises the operational risk for any unpatched instance.

Root Cause

The root cause is missing input validation and the absence of prepared statements when constructing the SQL query for the delete_fees action. The ID parameter is treated as a trusted integer despite originating from a client-side request. Without type casting or parameterized queries, any string content in ID is interpreted by the MySQL backend as query syntax.

Attack Vector

The attack vector is network-based. An attacker authenticates to the application, then issues an HTTP request to /ajax.php?action=delete_fees with a malicious ID payload. Typical payloads use UNION SELECT, boolean-based blind injection, or time-based techniques to exfiltrate database contents. Successful exploitation can disclose stored credentials, manipulate fee records, or destroy data through stacked queries when the database driver permits them.

No verified proof-of-concept code has been published in the references provided. Technical details are available in the GitHub CVE Issue Discussion and the VulDB Entry #332609.

Detection Methods for CVE-2025-13274

Indicators of Compromise

HTTP requests to /ajax.php?action=delete_fees containing SQL metacharacters such as ', ", --, UNION, SLEEP(, or INFORMATION_SCHEMA
Unusually long or URL-encoded values in the ID parameter
Web server logs showing repeated delete_fees requests from a single source within a short window
Unexpected DELETE, SELECT, or UNION activity in MySQL general or slow query logs tied to the application user

Detection Strategies

Inspect web access logs for the action=delete_fees parameter combined with non-numeric ID values
Deploy a web application firewall (WAF) signature targeting SQL injection patterns on the ajax.php path
Correlate authentication events with subsequent delete_fees requests to identify low-privilege accounts probing the endpoint
Alert on database errors returned by the application, which often accompany failed injection attempts

Monitoring Recommendations

Enable MySQL query logging on the application database and forward logs to a centralized SIEM
Monitor outbound connections from the application server for signs of data exfiltration following suspicious requests
Track changes to the fees table and related tables for unauthorized record deletion
Review newly created or modified database users that could indicate post-exploitation persistence

How to Mitigate CVE-2025-13274

Immediate Actions Required

Restrict access to the Campcodes School Fees Payment Management System to trusted networks until a vendor patch is available
Disable or block the /ajax.php?action=delete_fees endpoint at the reverse proxy or WAF layer if the function is not in active use
Rotate database credentials and review accounts with access to the application database
Audit existing user sessions and revoke low-privilege accounts that are not strictly required

Patch Information

No vendor advisory or patch has been published in the available references. Refer to the CampCodes vendor site for updates. Until a fix is released, treat all installations of version 1.0 as vulnerable.

Workarounds

Place a WAF in front of the application and enforce strict numeric validation on the ID parameter for all ajax.php actions
Apply MySQL least-privilege principles so the application account cannot read system tables or execute administrative statements
Modify the source to use prepared statements with parameter binding for the delete_fees query if local changes are feasible
Limit application accounts and require strong authentication to reduce the pool of users who can reach the vulnerable endpoint

bash

# Example NGINX rule to block non-numeric ID values on delete_fees
location = /ajax.php {
    if ($arg_action = "delete_fees") {
        if ($arg_id !~ "^[0-9]+$") {
            return 403;
        }
    }
}