A critical SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially exfiltrate sensitive data.

The application fails to properly sanitize the ID argument within the Recruitment/index.php?page=view_vacancy endpoint. This SQL injection flaw can be triggered remotely by an unauthenticated attacker to manipulate backend database operations.

Successful exploitation of this vulnerability permits unauthorized database interaction, which may lead to the exposure of applicant data, credentials, or other sensitive recruitment information. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches and a loss of organizational trust.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected recruitment portal or implement strict input validation rules to block malicious SQL syntax.

Proactive Monitoring: Review web server access logs for suspicious patterns in URL parameters, specifically looking for SQL keywords or anomalous character sequences directed at the view_vacancy page.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified vulnerable parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Due to the public availability of exploit code and the lack of an official vendor patch, this vulnerability poses a significant risk to any organization running the affected software. Security teams must prioritize isolating the vulnerable system from public access or applying robust WAF filtering to prevent unauthorized database access until a formal security update is released by the vendor.