An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to execute arbitrary database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/save_student.php script. An unauthenticated remote attacker can manipulate the class_id parameter to inject malicious SQL commands into the application database.

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this represents a high-risk security flaw that could compromise the integrity and confidentiality of student records and administrative data stored within the system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the affected script to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected union-based queries originating from the /admin/save_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the class_id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability poses a significant risk to the integrity of the application. Organizations should prioritize restricting access to the administrative interface and implement robust input validation as a stopgap measure until the vendor releases a secure update.