A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

This vulnerability is a SQL injection flaw located in the /ajax.php endpoint, specifically triggered via the ID parameter. An unauthenticated remote attacker can inject malicious SQL commands to manipulate backend database operations.

The exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification of payroll records, or potential system instability. With a CVSS score of 7.3, this flaw presents a high risk to business operations, as the lack of required authentication makes it easily accessible to remote threat actors.

Immediate Action: As there is no official patch available, administrators should restrict network access to the /ajax.php endpoint and consider disabling the affected functionality if it is not business critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests containing SQL syntax patterns or unusual characters directed toward the ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability poses a significant risk to affected installations. Organizations must prioritize immediate mitigation by implementing WAF rules and restricting access to the vulnerable endpoint until a formal security update is released by Campcodes.