CVE-2025-9744

MEDIUMNuclei

Campcodes Online Loan Management System ajax.php sql injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-9744 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.

Description

A weakness has been identified in Campcodes Online Loan Management System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Executing manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 2, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Online Loan Management System

Browse Campcodes / Online Loan Management System
CVE List1.0affected

Nuclei templates

1
ProjectDiscoveryCRITICALLoan Management System 1.0 - SQL InjectionCVSS 10

Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can bypass authentication and gain full administrative access through SQL injection in the username parameter, potentially compromising the entire loan management system.

Remediation

Upgrade Loan Management System to a patched version that properly sanitizes user input in authentication handling.

WeaknessesCWE-89
Authorsarafatansari
Template tagscvecve2025auth-bypasscmspacketstormedbloancmssqlivuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
https://www.exploit-db.com/exploits/50402 https://packetstormsecurity.com/files/167860/Loan-Management-System-1.0-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2025-9744

Source: ProjectDiscovery

References

5