Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=login endpoint. This vulnerability allows remote attackers to manipulate the Username parameter to execute arbitrary SQL commands. The vulnerability has a high severity score of 7.3 and public exploit code is available.