A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to remotely manipulate database queries.

The application fails to properly sanitize the Username parameter within the student_signup.php script, which facilitates SQL injection. This vulnerability is remotely exploitable by unauthenticated users, as confirmed by the CVSS attack vector.

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to student records, administrative credentials, or full database exposure. With a CVSS score of 7.3, this high severity flaw warrants immediate attention to prevent potential system compromise or data exfiltration.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the affected registration portal if it is not business-critical. Users are advised to monitor the official Campcodes website for urgent security updates.

Proactive Monitoring: Security teams should review server access logs for anomalous patterns in HTTP requests directed at student_signup.php, specifically looking for SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the registration endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a credible risk to the integrity of the Learning Management System. Organizations using Campcodes Online Learning Management System 1.0 must prioritize the implementation of WAF protections and maintain a close watch for official remediation releases from the vendor.