An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a significant risk of unauthorized data access and potential database manipulation.

This is a SQL injection vulnerability (CWE-89) located in the admin/edit_class.php file. The application fails to properly sanitize the class_name argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and confidentiality of the learning management system database. Given the CVSS score of 7.3, this flaw presents a high risk of unauthorized data exposure or modification, which could lead to service disruption and significant reputational damage.

Immediate Action: Since a vendor-supplied patch is currently unavailable, administrators should restrict network access to the /admin/ directory and implement strict input validation for all administrative endpoints.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the admin/edit_class.php file, specifically looking for common SQL injection patterns such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the affected application parameters.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the CVE record.

Given the availability of a public proof-of-concept and the lack of a vendor patch, organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls. Immediate network-level restrictions and WAF filtering are required to mitigate the risk of unauthorized database interaction until the vendor provides a secure update.