A critical SQL injection vulnerability in Campcodes School File Management System 1.0 allows for remote, unauthenticated database manipulation.

This vulnerability is a SQL injection flaw (CWE-89) located within the update_query.php file. It is triggered by the manipulation of the stud_id parameter and can be executed by an unauthenticated remote attacker.

The ability to perform remote SQL injection poses a significant risk to the integrity and confidentiality of the underlying database. While the CVSS score of 7.3 reflects a High severity, the impact could include unauthorized data exposure or administrative access to the application data store, leading to potential operational disruption and loss of student records.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the update_query.php file or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for unusual characters or SQL syntax in requests targeting the update_query.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeting the stud_id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate threat to the environment. Organizations currently running Campcodes School File Management System 1.0 must prioritize restricting external access to the vulnerable script and monitoring for unauthorized database interaction until a formal vendor patch is applied.