An unauthenticated SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0 poses a significant risk of unauthorized database interaction and potential information disclosure.

The vulnerability exists within the ajax.php file, specifically via the login action. An unauthenticated attacker can inject malicious SQL commands into the Username parameter, leading to unauthorized database manipulation.

The ability for an unauthenticated user to execute arbitrary SQL commands presents a high risk to data integrity and confidentiality. With a CVSS score of 7.3, this flaw could allow an attacker to bypass authentication mechanisms, access sensitive student or financial records, or potentially modify system data. Such an incident could result in significant operational disruption and loss of sensitive institutional information.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web interface or implement input validation controls to sanitize the Username parameter. If possible, disable the vulnerable login functionality until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious patterns or anomalous characters in login requests directed at ajax.php. Monitor database query logs for unexpected syntax errors or unauthorized access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes School Fees Payment Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, to mitigate the risk until the vendor releases a formal security patch. Continuous monitoring for signs of unauthorized access is essential for maintaining the security posture of the affected system.