A critical SQL injection vulnerability in the Campcodes Online Learning Management System allows unauthenticated remote attackers to compromise database integrity.

The application is susceptible to SQL injection (CWE-89) within the Username argument of the /admin/login.php file. This flaw is remotely exploitable by unauthenticated attackers, allowing them to manipulate database queries.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive educational or user data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to a complete compromise of the application's user authentication mechanism.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/login.php file or the entire application to trusted IP ranges until a security update is released by Campcodes.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically those containing SQL syntax characters, originating from the login interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes — a public proof of concept is available via the researcher's GitHub issue tracker.

This vulnerability presents a clear and present danger to the confidentiality of your system data. Because the exploit is publicly available and requires no authentication, you must prioritize restricting access to the affected login page immediately. Monitor for any signs of unauthorized database interaction and engage the vendor for a definitive patch as soon as one becomes available.