A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the school_year argument within the /admin/school_year.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Successful exploitation of this SQL injection vulnerability could allow an attacker to view, modify, or delete sensitive data stored within the database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to unauthorized access to administrative functions or student information. Such a breach could result in significant reputational damage and regulatory non-compliance.

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests containing SQL syntax patterns targeting the school_year.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical documentation provided at the GitHub reference link.

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize restricting network access to the affected administrative interface until an official vendor patch is released and verified.