CVE-2025-12873 Campcodes School File Management update_user.php sql injection
Remote attackers can perform SQL injection via the user_id parameter in update_user.php, potentially accessing or modifying database records.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12873?
CVE-2025-12873 is a medium-severity SQL injection vulnerability in Campcodes School File Management, published on 7 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
Which versions are affected by CVE-2025-12873?
It affects 1 product.
Products include Campcodes School File Management System.
How do I fix CVE-2025-12873?
No fix has been published for CVE-2025-12873 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-12873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12873 exists.
Other vulnerabilities in Campcodes School File Management
Sources
Also known as GHSA-g79x-4qm3-4xp7.