A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries.

This is a SQL injection flaw (CWE-89) located in the department argument of the admin/teachers.php script. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or faculty information, potential modification of database records, or a complete compromise of the learning management platform. Given the CVSS score of 7.3, this represents a high-severity threat that requires immediate attention to prevent unauthorized data exposure.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/teachers.php endpoint or disable the affected module until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the /admin/teachers.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until an official fix is released.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

This vulnerability presents a high risk due to the lack of required authentication for exploitation. Security teams must prioritize restricting access to the vulnerable endpoint immediately. Organizations should actively monitor vendor communications for a security patch and apply it as soon as it becomes available to remediate the underlying code vulnerability.