An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database interaction and potential data exposure.

The application is susceptible to SQL injection (CWE-89) within the /admin/edit_student.php file via the cys parameter. This vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive student or system data stored in the database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in full database compromise, data exfiltration, or loss of system integrity. Such an incident poses significant risks to institutional data privacy and operational continuity.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/edit_student.php file to trusted IP addresses only or disable the affected module entirely.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the edit_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application parameters.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://github.com/luyisi-7/CVE/issues/5).

The presence of a public proof-of-concept and the lack of a vendor-supplied patch necessitate immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize isolating the affected component to prevent unauthorized access. Monitor for updates from the vendor and apply them as soon as they become available to permanently remediate this SQL injection flaw.