Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=delete_fees endpoint. Manipulating the ID parameter in this request can allow an attacker to execute unauthorized SQL commands remotely. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. Public exploit code is available, but no official patch or remediation has been provided yet.