A critical SQL injection vulnerability in the Campcodes Online Recruitment Management System allows unauthenticated remote attackers to execute arbitrary database queries.

The application is susceptible to SQL injection via the ID parameter in the /admin/ajax.php file when the action is set to save_recruitment_status. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive applicant data, modification of recruitment records, or potential administrative compromise of the underlying database. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, necessitating immediate attention to prevent unauthorized data exfiltration.

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ajax.php endpoint or disable the affected functionality entirely until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/ajax.php, particularly those containing SQL syntax characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the recruitment system.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be treated as high priority. Organizations currently running Campcodes Online Recruitment Management System 1.0 must implement strict network-level access controls to isolate the vulnerable endpoint until an official patch is provided by the vendor.