CVE-2025-11422 is a High severity (CVSS 7.3) SQL injection in Campcodes Advanced Online Voting Management System 1.0. The Username argument handled by /admin/login.php can change the database query. The record names no patched release, so restrict access, switch the query to prepared statements and ask the vendor for a fix.
What's affected
The record lists Campcodes Advanced Online Voting Management System 1.0. The affected file is /admin/login.php, and the argument named in the record is Username. The weakness types are CWE-74 (injection) and CWE-89 (SQL injection). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable with no login needed.
The record says the exploit has been published. That is not the same as attacks being seen. The CVE is not in the CISA KEV catalog, and I found no advisory that reports use in the wild. Public exploit details still make scanning for the flaw easy, so exposed installs deserve attention.
No vendor advisory or fixed version is listed in the record, and I could not confirm one from the public issue report. Check the vendor's site, listed as a reference in the record, for updates.
How to check if you're exposed
First confirm you run this product. Look for the application folder on your web server and check the version in its readme, admin footer or release notes. The record only names 1.0, so treat other versions as unverified rather than safe.
Then look at the code. From the application's root directory, these commands show where the file lives and how the argument is used:
find . -name "login.php"
grep -n "Username" admin/login.php
grep -rnE "(mysqli_query|mysql_query)" --include=*.php .
Any hit that builds a query by joining strings with the request value, rather than passing it as a bound parameter, is a candidate for this class of flaw.
What to do now
- Take the application off the public internet, or put it behind a VPN or an IP allow list, while you decide what to do.
- Change the query that uses Username so the value is bound as a parameter. Example of the safe shape in PHP:
$stmt = $mysqli->prepare("SELECT id FROM records WHERE name = ?");
$stmt->bind_param("s", $value);
$stmt->execute();
- Give the application's database account only the rights it needs. It should not own the schema or reach other databases.
- Check web server logs for requests to /admin/login.php with quote marks, SQL keywords or very long values in the Username field.
- Ask the vendor for a patch. If none is published, plan to replace the application, or maintain your own fixed copy of the code.
- Apply the same fix to every other page that builds queries from request values, since one bug often means several.
Why it matters
SQL injection happens when user input becomes part of a database command instead of being treated as data. The database then cannot tell the developer's intent from the attacker's text. The effect depends on the application and the database account, and ranges from reading rows to changing or deleting them.
This is a long standing weakness class with a standard cure. The tradeoff is that small PHP applications often have no maintainer to ship the cure, so you may need to carry the fix yourself. See CWE-89 for the general pattern.
Quick check
Is there a patched version of Campcodes Online Voting?
The record names no fixed release. Check the vendor's site, and apply the code level and network controls in this post in the meantime.
Is CVE-2025-11422 exploited in the wild?
The record says an exploit has been made public, which is different from reported attacks. The CVE is not in the CISA KEV catalog, and I found no advisory saying it is exploited. Public exploit details still raise the risk for exposed sites.
Sources
- Public issue report listed in the record
- NVD record for CVE-2025-11422 (description, CVSS vector, CWEs)
To find known issues in the open source libraries behind your own projects, run the free in-browser dependency scan.
Last reviewed: 19 October 2026.
