A critical SQL injection vulnerability in Campcodes Advanced Online Examination System 1.0 allows unauthenticated attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) located in the /query/loginExe.php file. An unauthenticated attacker can supply malicious input via the username POST parameter to manipulate backend database queries.

Successful exploitation of this vulnerability permits unauthorized access to the application database, which may result in sensitive data leakage, data tampering, or total system compromise. Given the CVSS score of 7.3 and the unauthenticated nature of the attack vector, this flaw represents a significant risk to the confidentiality and integrity of student and administrative data.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login portal via network-level controls or disable the application until a secure version is released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to /query/loginExe.php, specifically identifying patterns associated with SQL injection payloads, such as time-based sleep commands or SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the username parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an elevated risk. Organizations currently utilizing Campcodes Advanced Online Examination System 1.0 must prioritize isolating the affected server from public networks and implementing strict input validation or WAF rules to prevent unauthorized database access while awaiting a vendor-supplied update.