An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a significant risk of unauthorized database interaction and potential data compromise.

This vulnerability is an SQL injection flaw (CWE-89) located in the /admin/class.php file. It allows an unauthenticated, remote attacker to perform malicious operations by manipulating the class_name argument.

The ability for an unauthenticated attacker to execute arbitrary SQL commands presents a high risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive student or administrative data, potentially resulting in full database compromise and significant reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until the vendor releases a security update.

Proactive Monitoring: Review web server logs for suspicious HTTP requests targeting /admin/class.php, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the specified vulnerable parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the public availability of exploit code and the critical nature of SQL injection, this vulnerability requires immediate attention. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize implementing the suggested compensating controls and monitor for vendor updates to ensure long-term mitigation of this high-risk entry point.