A critical SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries.

This vulnerability is a SQL injection (CWE-89) flaw located in the file /admin/ajax.php. An unauthenticated attacker can supply malicious input to the ID argument to execute unauthorized database commands.

The ability to perform remote SQL injection allows an attacker to potentially extract, modify, or delete sensitive data stored within the recruitment system database. With a CVSS score of 7.3, this flaw poses a high risk to the confidentiality and integrity of applicant and administrative information, potentially leading to unauthorized data access or service disruption.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/ajax.php, particularly those containing SQL syntax characters such as single quotes, dashes, or union keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at the provided GitHub reference.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a significant risk to affected installations. Organizations must prioritize network-level restrictions to prevent unauthorized access to the vulnerable administrative endpoint until the vendor releases a security update.