A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows for unauthenticated remote data manipulation and potential system compromise.

This is a SQL injection vulnerability (CWE-89) triggered via the Title argument in the /admin/edit_content.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

The vulnerability carries a CVSS score of 7.3, reflecting a high risk of unauthorized database interaction. Successful exploitation could lead to unauthorized data access, modification of educational content, or potential full database compromise, which may result in significant reputational damage and loss of system integrity for the institution.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /admin/edit_content.php, particularly those containing SQL syntax characters in the Title parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize inputs containing common SQL injection payloads targeting the identified endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of a public exploit and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to any deployment of Campcodes Online Learning Management System 1.0. Organizations should prioritize isolating the affected application from public-facing network segments and implement strict input validation via a WAF until a secure update is released by the vendor.