CVE-2025-9492
Campcodes Online Water Billing System addclient1.php sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 26, 2025
- Updated
- Aug 27, 2025
- Reserved
- Aug 26, 2025
Description
A vulnerability was determined in Campcodes Online Water Billing System 1.0. This affects an unknown function of the file /addclient1.php. Executing manipulation of the argument lname can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Online Water Billing SystemCampcodes |
|
References
- VDB-321473 | Campcodes Online Water Billing System addclient1.php sql injectionvdb-entrytechnical-description
- VDB-321473 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #635352 | Campcodes Online Water Billing System V1.0 SQL Injectionthird-party-advisory
- https://github.com/skyrainoh/CVE/issues/9exploitissue-tracking
- https://www.campcodes.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.