A critical SQL injection vulnerability exists in Campcodes Online Learning Management System 1.0, posing a significant risk of unauthorized database interaction and data exposure.

This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/add_content.php file. An unauthenticated remote attacker can inject malicious SQL commands via the Title parameter, potentially leading to unauthorized database access.

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to the confidentiality, integrity, and availability of the underlying database. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative data, or modify system content, leading to significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin directory and ensure that all input fields are properly sanitized or parameterized at the source code level.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the /admin/add_content.php endpoint, specifically looking for common SQL injection patterns like single quotes, union selects, or comment characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts, which can provide a necessary layer of protection until the vendor provides a formal update.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability record.

Given the availability of public proof-of-concept code and the high potential for database compromise, this vulnerability requires immediate attention. Security teams must prioritize restricting access to the affected management interfaces and implement robust WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.