A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection (CWE-89) flaw located within the /ajax.php?action=save_payment file. It allows an unauthenticated attacker to manipulate the loan_id argument to execute arbitrary SQL commands against the backend database.

The ability to perform unauthenticated SQL injection poses a severe risk to data confidentiality and integrity. Given the CVSS score of 7.3, this flaw could lead to unauthorized data exfiltration, modification of loan records, or complete database compromise, potentially resulting in significant reputational damage and operational downtime.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /ajax.php endpoint or disable the affected payment functionality until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the /ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the loan_id parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced at https://github.com/skyrainoh/CVE/issues/10.

Due to the lack of an official patch and the availability of a public exploit, this vulnerability presents an immediate and elevated risk to all deployments of Campcodes Online Loan Management System 1.0. Organizations should treat this as a high priority item, implementing strict network access controls or disabling the vulnerable module immediately to prevent unauthorized database access.