A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk to data integrity.

This is a SQL injection vulnerability (CWE-89) triggered through the ID argument in the /ajax.php?action=save_loan_type endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

The ability to perform unauthenticated SQL injection allows an attacker to interact directly with the backend database. This could lead to unauthorized data exposure, modification of loan records, or potential administrative account takeover, resulting in significant operational disruption and loss of trust. With a CVSS score of 7.3, this flaw represents a high risk to the confidentiality and integrity of financial management systems.

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the affected /ajax.php endpoint or disable the vulnerable loan management module entirely until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for anomalous requests to the /ajax.php file, specifically looking for unusual patterns or SQL keywords in the ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/Sxxxw/cve/issues/1.

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, organizations must treat this as a high-priority risk. Administrators should immediately implement restrictive access controls on the affected file and monitor for any signs of exploitation while awaiting a formal security update from Campcodes.