A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries.

The application is susceptible to SQL injection (CWE-89) within the /admin/edit_teacher.php script. An unauthenticated attacker can supply malicious input to the department parameter to execute arbitrary SQL commands against the database.

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation may allow an attacker to unauthorizedly access, modify, or delete sensitive information stored within the learning management system database. Given the CVSS score of 7.3, this flaw represents a high risk to organizational assets, potentially leading to total system compromise or unauthorized data exfiltration.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/edit_teacher.php endpoint to trusted network segments or authorized personnel only.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting /admin/edit_teacher.php that contain SQL syntax, such as UNION, SELECT, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the department argument.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's write-up at https://github.com/xiaolonr/cve/issues/1.

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability presents a high risk to deployments of Campcodes Online Learning Management System 1.0. Organizations should immediately restrict access to the affected administrative interface and implement robust WAF filtering. Prioritize migrating to a more secure platform or applying vendor-provided security updates as soon as they are released.