CVE Alert: CVE-2025-9502 – Campcodes – Online Loan Management System

Risk verdict

High risk: a remote, unauthenticated SQL injection in a public-facing endpoint with a publicly available exploit; urgent to patch and mitigate.

Why this matters

Exploitation can expose or modify customer data and payment records, risking financial loss, fraud, and regulatory exposure. The combination of network access and no user interaction means attackers can act directly against the database, potentially leaking PII and impacting availability.

Most likely attack path

An attacker can trigger the flaw via the loan_id parameter in /ajax.php?action=save_payment over the internet without credentials. The CVSS metrics indicate remote, unauthenticated access with limited impact to confidentiality, integrity, and availability, making rapid data exfiltration or tampering feasible if protections are not in place. Given the public PoC, opportunistic exploitation is likely to rise, with limited prerequisites for lateral movement beyond the app’s DB layer.

Who is most exposed

Any deployment of Campcodes Online Loan Management System v1.0 that is internet-facing—typically small to mid-sized lenders hosting the software themselves or via a hosted service—faces this risk. Public-facing payment processing functionality is the primary exposure.

Detection ideas

• Sudden spikes in requests to /ajax.php?action=save_payment with unusual loan_id values
• SQL error messages or database-timeout patterns in application or DB logs
• Anomalous data access: unexpected rows returned from payment or loan tables
• Unusual outbound data transfers or large DB query results
• WAF alerts for SQL injection patterns around user input fields

Mitigation and prioritisation

• Apply patch or hotfix that parameterises queries and eliminates dynamic SQL in ajax.php
• Implement strict input validation and prepared statements for loan_id and related parameters
• Enforce least-privilege DB accounts and separate app/db roles; disable unnecessary high-privilege access
• Deploy web application firewall rules targeting SQLi patterns; suppress detailed error messages
• Schedule a change window for patch rollout and verify with functional and security testing
• If KEV is true or EPSS ≥ 0.5, treat as priority 1. Otherwise, escalate to high-priority patching within the next available window.