An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to compromise the database.

This is a SQL injection vulnerability (CWE-89) affecting the /admin/department.php file. An unauthenticated remote attacker can inject malicious SQL commands via the d parameter to potentially access or manipulate backend data.

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive student or administrative information. Given the CVSS score of 7.3, this flaw presents a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/department.php endpoint to authorized internal networks only or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed toward the department.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and monitor for unusual database query activity.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability creates an urgent need for mitigation. Organizations using Campcodes Online Learning Management System 1.0 must prioritize restricting network access to the vulnerable endpoint immediately, as the lack of a vendor patch leaves the system exposed to potential remote exploitation.