A critical SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

The application is susceptible to SQL injection (CWE-89) within the index.php file. An unauthenticated remote attacker can inject malicious SQL commands via the searchfor argument, enabling unauthorized database interaction.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potential modification of application records, or service disruption. With a CVSS score of 7.3, this flaw represents a significant risk, as it requires no prior authentication and can be executed remotely to bypass standard security controls.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable index.php endpoint or disable the search functionality until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or sleep commands, targeting the searchfor parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious input directed at the vulnerable application parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/HAO-RAY/HCR-CVE/issues/7.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to the confidentiality and integrity of the system. Organizations should prioritize isolating affected instances from public networks and implementing robust WAF filtering to mitigate the threat until a formal update is provided.