CVE Alert: CVE-2025-9751 – Campcodes – Online Learning Management System

Risk verdict

High risk due to publicly disclosed, unauthenticated remote SQL injection with PoC availability; remediation should be treated as urgent.

Why this matters

An attacker can target login handling over the network and potentially bypass authentication to access or exfiltrate user data, disrupt access, or pave the way for further compromise within the LMS. Even with low per-incident impact, the ease of exploitation across the web surface increases exposure across student, faculty, and admin accounts.

Most likely attack path

Exploitation requires no user interaction and no privileges: an attacker sends crafted input to login.php, triggering SQL injection to bypass authentication or retrieve data. The network-accessible nature (AV:N, PR:N) enables automated scanning and mass attempts, with low detection requirements given no UI or auth barriers. Scope remains unchanged, so confined impacts could still be leveraged for lateralFootprint within the app’s data store.

Who is most exposed

Internet-facing deployments of Campcodes LMS v1.0, especially in educational institutions using publicly accessible login endpoints or poorly shielded environments, are at greatest risk.

Detection ideas

• Web logs show suspicious payloads targeting login.php (e.g., classic SQLi patterns, taut quotes, UNION SELECT).
• Authentication events preceded by unusual query strings or unexpected data returned from the DB.
• Increased DB query latency or errors from login endpoints.
• WAF/IPS alerts for SQL injection signatures on login.php.
• PoC indicators or tool signatures in security telemetry.

Mitigation and prioritisation

• Apply vendor patch or upgrade to a non-vulnerable release as a priority; if unavailable, implement compensating controls.
• Implement input handling: parameterised queries, prepared statements, and robust server-side validation for login inputs.
• Deploy WAF/IPS rules to block common SQLi patterns targeting login.php; monitor for repeated attempts.
• Disable or tightly constrain direct database access from web front-end where feasible; implement least-privilege DB accounts.
• Change-management: plan rapid deployment across affected instances; verify integrity post-upgrade and conduct targeted security testing.