An unauthenticated SQL injection vulnerability in Campcodes Online Loan Management System 1.0 poses a significant risk of unauthorized database manipulation.

The application is susceptible to SQL injection via the ID argument in the /ajax.php?action=delete_payment endpoint. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands remotely.

The ability to perform SQL injection against a financial management system can lead to the unauthorized disclosure, modification, or deletion of sensitive loan and payment data. Given the CVSS score of 7.3, this high-severity flaw could result in significant operational disruption and compromise the integrity of financial records.

Immediate Action: As no official patch is currently available, contact the vendor for security updates and restrict access to the affected web directory via network-level controls.

Proactive Monitoring: Review application access logs for suspicious requests targeting the /ajax.php script, particularly those containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to filter and block malicious SQL injection payloads targeting the identified endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running Campcodes Online Loan Management System 1.0 must prioritize implementing compensating controls, such as WAF rules, and restrict network access to the vulnerable endpoint until an official vendor patch is released and verified.