A critical SQL injection vulnerability in the Campcodes Online Recruitment Management System allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw located in the admin/ajax.php file, specifically within the save_user function. An unauthenticated attacker can exploit this remotely by manipulating the ID argument to execute arbitrary SQL commands.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive recruitment data, including user credentials and personal applicant information. Given the CVSS score of 7.3, this flaw poses a high risk to data confidentiality and integrity, potentially leading to full database compromise if the application service account holds excessive privileges.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the vulnerable ajax.php endpoint.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the admin/ajax.php file, particularly those containing SQL syntax characters like single quotes or dashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases a secure update.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at https://github.com/CVE-Hunter-Leo/CVE/issues/2.

Given the public availability of exploit code and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing this system must prioritize network segmentation and WAF-based filtering to block external access to the vulnerable administration endpoint until a formal security update is verified and applied.