An unauthenticated SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

This flaw is a SQL injection vulnerability (CWE-89) located in the advancesearch.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL queries into the backend database.

The ability to perform unauthenticated SQL injection permits attackers to bypass application logic, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this vulnerability represents a high risk to the confidentiality and integrity of the system, which could result in significant reputational damage and loss of sensitive user information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the online job search functionality entirely until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to advancesearch.php, specifically monitoring for patterns containing SQL syntax such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the Username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher write-up at https://github.com/HAO-RAY/HCR-CVE/issues/5.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be treated as a high priority. Organizations utilizing Campcodes Online Job Finder System 1.0 must implement strict WAF filtering immediately and monitor for unauthorized database activity while awaiting an official security update from the vendor.