Campcodes Online Learning Management System version 1.0 is vulnerable to a remote SQL injection attack that allows unauthenticated adversaries to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/calendar_of_events.php file. An unauthenticated remote attacker can trigger the vulnerability by injecting malicious payloads into the date_start parameter.

Successful exploitation of this SQL injection vulnerability could allow an attacker to gain unauthorized access to the application database. Given the CVSS score of 7.3, this represents a significant risk, potentially resulting in data exfiltration, modification of administrative records, or complete compromise of the learning management system environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements to prevent unauthenticated remote access.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically looking for SQL syntax characters or unexpected strings within the date_start parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting administrative endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/Rowantu/CVE/issues/2.

Due to the lack of an official patch and the presence of a public proof-of-concept, this vulnerability poses an elevated risk to the availability and integrity of the system. Organizations should immediately implement network-level access controls to isolate the vulnerable administrative endpoint until a vendor-supplied update is released.