CVE-2025-9502: Campcodes Online Loan Management System ajax.php sql injection
A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=savepayment. Executing manipulation of the argument loanid can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9502?
CVE-2025-9502 is classified as a critical vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2025-9502?
To fix CVE-2025-9502, you should sanitize and validate user inputs, particularly the loan_id parameter in ajax.php.
What systems are affected by CVE-2025-9502?
CVE-2025-9502 affects the Campcodes Online Loan Management System version 1.0.
Can CVE-2025-9502 be exploited remotely?
Yes, CVE-2025-9502 can be exploited remotely by manipulating the loan_id argument.
What are the potential impacts of CVE-2025-9502?
Exploitation of CVE-2025-9502 may allow an attacker to execute arbitrary SQL commands and gain unauthorized access to the database.