Campcodes Online Learning Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized database interaction.

This vulnerability is an SQL injection flaw (CWE-89) located in the teacher_signup.php file, specifically triggered via the firstname parameter. The flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the application database.

Successful exploitation of this vulnerability allows unauthorized access to or manipulation of the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to the exposure of sensitive user information, administrative credentials, or full application compromise. Organizations relying on this platform for educational management face potential data breaches and service disruption.

Immediate Action: As no official patch is currently available, administrators should restrict access to the teacher_signup.php endpoint or disable the registration functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unusual syntax or unexpected SQL keywords, specifically originating from the teacher_signup.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect incoming requests for SQL injection payloads targeting the firstname parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

The presence of a public proof-of-concept elevates the risk of this vulnerability to a credible threat. We strongly recommend that administrators audit their implementations of Campcodes Online Learning Management System immediately and apply the suggested compensating controls to prevent potential exploitation until an official vendor patch is provided.