Paper/Archive/CVE-2025-14514

CVE-2025-14514

Campcodes Supplier Management System — Campcodes Supplier Management System add_distributor.php sql injection

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 35.8.358 × 207.2 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of the argument txtDistributorAddress causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Affected

ProductAffectedFixed inSource

Supplier Management System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.335852 refvuldb.com/?ctiid.335852 writeupvuldb.com/?submit.702752 writeupvuldb.com/?submit.702760 refgithub.com/ProgramShowMaker/CVE/issues/4 exploitgithub.com/ProgramShowMaker/CVE/issues/5 refcampcodes.com