A remote SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to potentially compromise database integrity.

This is a SQL injection vulnerability (CWE-89) located in the /admin/edit_subject.php file. The application fails to properly sanitize the subject_code parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Successful exploitation of this flaw can lead to unauthorized access to sensitive data stored within the database or potential modification of learning management records. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or unauthorized administrative actions. Organizations relying on this system for educational management face significant reputational risk and data privacy concerns if the database is compromised.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the /admin directory using network-level controls or web application firewall rules.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION or SELECT statements appearing within the subject_code parameter, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block SQL injection patterns targeting the subject_code argument in the edit_subject.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitHub issue.

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied patch is identified and applied. Failure to restrict access to this vulnerable endpoint leaves the system susceptible to unauthorized data manipulation.