Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=delete_payment endpoint. Manipulating the ID parameter allows remote attackers to execute unauthorized SQL commands. Public exploit code is available, increasing the risk of exploitation. The vulnerability has a medium severity rating with a CVSS score of 6.3.