A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

The vulnerability resides in the ajax.php file, specifically within the delete_allowances function. An unauthenticated attacker can supply a malicious ID parameter to perform SQL injection, potentially leading to unauthorized data access or modification.

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to the confidentiality and integrity of payroll data. Successful exploitation could lead to unauthorized extraction of sensitive employee information or the corruption of system records, resulting in severe operational disruption and potential regulatory non-compliance. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized database interaction.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected ajax.php endpoint via network controls or disable the vulnerable payroll module until a security update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests to ajax.php and monitor database query logs for suspicious activity or syntax errors indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting parameters in the URL query string.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability research.

Given the availability of a public proof-of-concept and the ease of exploitation via the unauthenticated ajax.php endpoint, this vulnerability represents a significant risk to the environment. Organizations should prioritize isolating the affected component and implement robust WAF filtering immediately. Maintain close contact with the vendor for the release of an official security patch to permanently resolve this injection flaw.