A critical SQL injection vulnerability in the Campcodes School Fees Payment Management System allows unauthenticated remote attackers to manipulate database queries.

This is a SQL injection vulnerability (CWE-89) affecting the manage_course.php file, where insufficient input validation on the ID argument allows an unauthenticated attacker to execute arbitrary SQL commands.

The ability for an unauthenticated remote attacker to inject SQL commands poses a significant threat to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or financial records stored within the database, potentially resulting in data exfiltration or system compromise. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized database manipulation.

Immediate Action: Since no official patch is currently available, users should restrict network access to the application or disable the vulnerable manage_course.php file if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests containing SQL syntax or unusual parameters targeting the manage_course.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application.

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the research documentation provided by ASantsSec on GitHub.

The presence of a public proof-of-concept combined with the lack of an official patch makes this a high-priority risk. Organizations utilizing this system must implement immediate network-level protections or WAF filtering to mitigate the threat of remote SQL injection. Security teams should prioritize moving this application behind restrictive access controls until the vendor provides a secure update.