An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database access and potential data compromise.

The vulnerability is a SQL injection flaw located within the add_subject.php file. An unauthenticated attacker can exploit this by injecting malicious input into the subject_code argument to execute unauthorized database commands.

The ability for an unauthenticated attacker to execute arbitrary SQL queries allows for the potential exfiltration, modification, or deletion of sensitive student and administrative data. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage, loss of data integrity, and potential non-compliance with data protection regulations.

Immediate Action: Since an official patch is currently unavailable, administrators should restrict access to the /admin/ directory to trusted internal IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests to /admin/add_subject.php, specifically searching for strings containing SQL syntax or unusual character patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection patterns targeting the subject_code parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/86.

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing Campcodes Online Learning Management System 1.0 must treat this as a high-priority item. Implement the recommended WAF rules and access restrictions immediately to prevent unauthorized exploitation while awaiting a formal vendor patch.