Campcodes Payroll Management System 1.0 is vulnerable to remote SQL injection, which could allow unauthorized database access and manipulation.

This is a SQL injection vulnerability (CWE-89) triggered through the ID parameter within the /ajax.php?action=save_deductions endpoint. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive payroll data, potential modification of financial records, or the extraction of database contents, which could result in regulatory non-compliance and reputational harm. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized system interaction.

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict access to the affected /ajax.php endpoint via network controls or disable the Payroll Management System until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests to /ajax.php, specifically monitoring for SQL syntax patterns or unexpected character strings in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application's input parameters.

Public Exploit Available: Yes, a published PoC exists, attributed to the researcher write-up at https://github.com/skyrainoh/CVE/issues/8.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a credible risk to the organization. Organizations currently utilizing Campcodes Payroll Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for signs of unauthorized database interaction until an official vendor update is provided and applied.