PT-2025-34817 · Unknown · Campcodes Online Water Billing System

L0Ners · Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-9492

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Campcodes Online Water Billing System version 1.0

Description: A vulnerability exists in Campcodes Online Water Billing System that allows for SQL injection. The issue affects an unknown function within the /addclient1.php file. Manipulation of the lname argument can lead to exploitation. The attack can be launched remotely, and the exploit has been publicly disclosed. Other parameters may also be affected.

Recommendations: As a temporary workaround, consider restricting access to the /addclient1.php file until a fix is available. Sanitize the lname argument to prevent SQL injection attacks. Review and sanitize all other parameters used in the /addclient1.php file to identify and address potential vulnerabilities.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-9492

Affected Products

Campcodes Online Water Billing System

References · 10

• 🔥 https://github.com/skyrainoh/CVE/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9492 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9492 · Vendor Advisory
• https://twitter.com/CVEnew/status/1960465983384047816 · Twitter Post
• https://vuldb.com/?ctiid.321473 · Note
• https://campcodes.com · Note
• https://t.me/cveNotify/133608 · Telegram Post
• https://t.me/CVEtracker/30968 · Telegram Post
• https://vuldb.com/?submit.635352 · Note
• https://vuldb.com/?id.321473 · Note