A critical file inclusion vulnerability exists in Campcodes Payroll Management System 1.0 that enables unauthenticated remote attackers to perform unauthorized file operations.

The application is susceptible to CWE-73: File Inclusion via the page parameter in the index.php script. This flaw permits an unauthenticated remote attacker to influence file path resolution, potentially leading to unauthorized information disclosure or system manipulation.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk to the organization. Successful exploitation could lead to the unauthorized exposure of sensitive payroll data, system compromise, or the execution of arbitrary code within the context of the web server, resulting in significant reputational and operational damage.

Immediate Action: Since a vendor-supplied patch is currently unavailable, administrators should immediately restrict access to the affected Payroll Management System instance until a secure update is released by Campcodes.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing directory traversal characters or unexpected file paths directed at index.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack patterns, such as directory traversal sequences, targeting the index.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue reference.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any environment hosting the Campcodes Payroll Management System. Organizations must prioritize restricting network access to the application or deactivating the service until the vendor provides a formal security update.