CVE-2025-9492

Name of the Vulnerable Software and Affected Versions: Campcodes Online Water Billing System version 1.0

Description: A vulnerability exists in Campcodes Online Water Billing System that allows for SQL injection. The issue affects an unknown function within the /addclient1.php file. Manipulation of the lname argument can lead to exploitation. The attack can be launched remotely, and the exploit has been publicly disclosed. Other parameters may also be affected.

Recommendations: As a temporary workaround, consider restricting access to the /addclient1.php file until a fix is available. Sanitize the lname argument to prevent SQL injection attacks. Review and sanitize all other parameters used in the /addclient1.php file to identify and address potential vulnerabilities.