Campcodes Online Learning Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

The application fails to properly sanitize the Username parameter within the login.php file, which facilitates a SQL injection attack. This vulnerability is remotely exploitable by unauthenticated attackers.

Successful exploitation of this flaw allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or the disclosure of sensitive information. Given the CVSS score of 7.3, this represents a high-severity risk to the confidentiality and integrity of the learning management system, which could result in significant operational disruption and data breach consequences.

Immediate Action: Since a specific patch is not currently identified, administrators should restrict access to the login portal via network-level controls or a Web Application Firewall until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous patterns or characters typically associated with SQL injection attempts, such as the use of single quotes, comment indicators, or SQL keywords in the username field.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection payloads targeting the login endpoint.

Public Exploit Available: Yes, a public proof-of-concept is available via the referenced GitHub issue.

This vulnerability presents a clear risk of unauthorized database interaction due to insufficient input validation. Organizations currently running Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and maintain close communication with the vendor for the release of an official security patch. Immediate action is required to reduce the attack surface until a permanent fix is available.