Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=save_payment endpoint. The flaw arises from improper handling of the ID argument, allowing remote attackers with limited privileges to manipulate SQL queries. The vulnerability has a CVSS score of 6.3 (medium severity) and public exploit details have been disclosed, though no known exploitation in the wild is reported. No patch or remediation information is currently available.