An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

The application suffers from a SQL injection vulnerability (CWE-89) within the /admin/admin_user.php script. An unauthenticated attacker can manipulate the firstname argument to execute malicious SQL queries remotely.

The ability to perform unauthorized SQL injection attacks against a learning management system can lead to the exfiltration of sensitive user data, credential theft, or total compromise of the application database. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to organizational confidentiality and system integrity.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and implement strict input validation for the firstname parameter.

Proactive Monitoring: Monitor server access logs for unusual HTTP requests containing SQL syntax or encoded payloads targeted at the admin_user.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns directed at the identified vulnerable script.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Given the availability of a public proof-of-concept, this vulnerability should be treated with urgency despite the current absence of a vendor patch. Organizations using Campcodes Online Learning Management System 1.0 must prioritize isolating the affected component and implementing robust network-level filtering to prevent unauthorized exploitation until a vendor-supplied fix is released.