A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries.

This is an SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the ID parameter within the /ajax.php?action=save_position endpoint. The vulnerability is remotely exploitable without requiring authentication.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive payroll information or the modification of critical system data. With a CVSS score of 7.3, this flaw represents a high-severity risk that could lead to full database compromise if the application service account lacks proper restrictions.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected /ajax.php endpoint via network controls or disable the Payroll Management System until a secure update is provided by Campcodes.

Proactive Monitoring: Review web server access logs for anomalous requests to the /ajax.php endpoint, specifically looking for URL parameters containing SQL syntax or unusual character sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability poses an immediate risk to any deployment of Campcodes Payroll Management System 1.0. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied patch is released and verified.