A critical SQL injection vulnerability in the Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to execute arbitrary database commands.

This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/de_activate.php file. An unauthenticated attacker can manipulate the ID argument to perform unauthorized database operations remotely.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could lead to unauthorized access to sensitive educational data, potential modification of administrative records, or complete compromise of the underlying database, causing significant reputational and operational damage to the institution.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable functionality if it is not business critical.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/de_activate.php, specifically monitoring for SQL syntax patterns or unexpected characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this specific endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation for unauthenticated users, this vulnerability poses a significant risk. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules and access restrictions, until the vendor provides a permanent security update.