A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize the ID argument within the /ajax.php?action=save_plan endpoint, which results in a SQL injection vulnerability. This flaw is accessible to unauthenticated remote attackers.

Successful exploitation of this vulnerability allows unauthorized actors to execute arbitrary SQL commands against the backend database. This may lead to the exfiltration of sensitive loan data, unauthorized modification of records, or potential service disruption, carrying a CVSS score of 7.3 which reflects a high risk to data confidentiality and integrity.

Immediate Action: Since no official patch is currently available, users should restrict network access to the affected /ajax.php endpoint or disable the vulnerable module if it is not business critical.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns containing SQL syntax, particularly directed at the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, organizations using Campcodes Online Loan Management System 1.0 must treat this as a high-priority risk. Immediately implement network-level restrictions or WAF rules to prevent exploitation until an official vendor update is released and applied.